# An Unprecedented Cyberattack on Taiwan: Experts Sound the Alarm **URL:** https://securesys.com.tr/en/blog/taiwan-cyberattack-run-by-autonomous-ai-agents Cyberattacks have for many years been one of the most significant digital threats facing states, companies and critical infrastructure. But the recent incident in Taiwan raises a question different from the attack scenarios we are used to: Can a significant part of a cyberattack now be carried out by AI agents rather than people? Findings that have emerged about the attack campaign targeting public institutions in Taiwan in July 2026 show that this question is no longer merely theoretical. Taiwan's Ministry of Digital Affairs stated that manual methods and AI agents were used together in the attacks on public institutions, and that the attacks originated from abroad. The operation, examined by the Israeli cybersecurity company Dream, revealed that the attackers used an AI-supported and highly autonomous structure. The significance of this incident is not only that Taiwan was targeted. The truly striking point is that the way cyberattacks are carried out has begun to change. ### AI Agents Were at the Centre of the Attack When we think of a traditional cyberattack, we usually picture an attacker working at a computer. The attacker researches the target. Scans systems. Identifies open ports and services. Investigates vulnerabilities. If one method does not work, they try another. Once they gain access, they try to move through the network. What stands out in the Taiwan incident is that a significant part of this process could be automated by AI agents. According to research reported by the Financial Times, up to eight autonomous AI agents operated simultaneously in the attack. These agents could examine different targets, research vulnerabilities and change their attack strategies according to the results they obtained. In other words, the attacker may no longer have to issue every command individually. We are moving towards a model in which the attacker sets the target and objective and leaves a significant part of the operation to AI systems. For cybersecurity, that represents an important threshold. ### 21 Systems, 85 Accounts and More Than 2,500 Personnel Records The findings shared by researchers also reveal the scale of the operation. The campaign targeted 21 Taiwanese public systems. At least 85 user accounts were reported compromised and more than 2,500 personnel records exfiltrated. It was stated that the operation was not limited to conventional public systems: the nuclear safety authority and some organisations in the energy sector were also among the targets. That detail matters particularly. Because the impact of a cyberattack is no longer measured by data loss alone. When critical infrastructure such as energy, communications, finance, transport and public services is targeted, cybersecurity becomes a matter of national security and operational continuity directly. ### Can an AI Agent Work Like a Hacker? This is precisely the most interesting question here. When an AI agent is given the ability to use certain tools, research online and create new tasks based on results, the system stops being a chatbot that merely answers questions. In an attack scenario, for example, an agent can: - discover target systems, - analyse services, - research potential vulnerabilities, - evaluate the results it obtains, - try different attack paths - and change its strategy when it fails. Now imagine all of this being carried out by several agents running at the same time. While one agent researches external systems, another can analyse the services found. While another investigates possible vulnerabilities, yet another can identify new targets using the access gained. The operational capacity available to the attacker can therefore grow considerably. So one of AI's most important effects on cybersecurity may not be "more advanced attacks" alone. The real change may be in scale and speed. ### The New Problem in Cyberattacks: Speed Imagine hundreds of alerts arriving at once in an organisation's security operations centre. In traditional attacks, attackers also have a certain operational capacity. But in AI-supported attacks, once a significant part of reconnaissance, analysis and trial processes is automated, attackers can work in parallel across far more targets. Some operations that would take a person hours can be done in minutes. Dozens of systems can be scanned at once. Different attack paths can be tried in parallel. Collected data can be analysed in real time to produce new attack decisions. And one of the biggest problems on the defensive side emerges here: while attacks become automated, can defence remain largely manual? In the long run it is clear that this is not sustainable. ### AI Is a "Force Multiplier" in Attackers' Hands It would not be right to read these developments as "hackers will no longer be needed". Statements from the Taiwanese authorities also point to human operators and AI agent techniques being used together in the attacks. So the more realistic scenario in the near future may be this: human attacker + AI agents. The attacker sets the target and the strategy. AI agents carry out reconnaissance and analysis. Tools automate the attack steps. The human operator makes decisions at critical points. This model can significantly increase the volume of operations achievable per attacker. Put differently, before replacing the attacker, AI is becoming a powerful force multiplier for the attacker. ### So Who Is Behind the Attack? Care is needed at this point. Taiwan has not officially stated that a particular country is behind the attack. Researchers note that some indicators in the attack infrastructure strengthen the possibility of a Chinese connection. But no direct and definitive attribution has been made. Technically, therefore, the soundest approach is to focus less on the source of the attack and more on the method used and the new risk model it reveals. Because techniques targeting Taiwan today may be used tomorrow against a financial institution, an energy company, a manufacturing plant or a public body. ### The Real Question: Are Organisations Ready? The message the Taiwan case sends to companies is fairly clear. Asking only "do our systems have a security product?" is no longer enough. There are more important questions: Are our critical systems genuinely visible? Are we continuously tracking our internet-facing assets? How long does it take us to notice when an attacker enters our network? Can we detect unusual behaviour by privileged accounts? Is data from EDR, XDR, NDR and SIEM systems assessed together? Can we see critical vulnerabilities before attackers do? Is our response process ready when a security incident occurs? And perhaps one of the most important questions of the coming period: can we answer an attack running at AI speed with an AI-supported defence? ### The "Test Once a Year" Era Is Closing The spread of AI-supported attacks may also change the approach to security testing. Testing a system once a year and closing the vulnerabilities found will remain important. But the attack surface changes constantly. New services go live. New users are created. Cloud resources are opened. APIs are published. New vulnerabilities are disclosed. Privileges change. Organisations therefore need to treat security as a continuously measured and monitored process rather than a one-off project. Attack Surface Management, Continuous Vulnerability Assessment, SOC, SIEM, EDR/XDR, NDR, Threat Intelligence and regular penetration testing are, for that reason, not independent security investments but parts of the same defensive architecture. ### AI Is Not Only the Attackers' Weapon Despite the gloomy side of this news, we have an important advantage. The technology attackers use is also in the hands of defence teams. AI can be used to: analyse millions of log records, identify abnormal user behaviour, detect suspicious network traffic, prioritise security alerts, analyse threat intelligence, accelerate incident response processes and reduce the investigation time of security teams. So the cybersecurity contest of the coming period will not take place between humans alone. Increasingly, it will take place between AI-supported attack and AI-supported defence. ### SecureSys Assessment: A New Era Is Beginning in Cybersecurity The attack campaign uncovered in Taiwan reminds us of an important reality: in the cybersecurity world, AI is no longer merely a supporting technology — it is becoming an operational actor. Today we see AI agents accelerating attackers' reconnaissance, analysis and attack processes. It would not be surprising to encounter far more autonomous attack infrastructure tomorrow. Organisations therefore need to prepare their defensive strategies not only against known attack methods, but against high-speed, automation-supported threats. Continuous security monitoring, current threat intelligence, attack surface management, penetration testing, Red Team exercises, EDR/XDR, NDR and 24/7 SOC operations are among the fundamental components of this new security model. Because in the coming period the attackers' greatest advantage may not only be the vulnerabilities they use. Their greatest advantage will be speed. And the task of the defence is to see faster, understand faster and respond faster than the attackers. #### Conclusion The incident in Taiwan should not be seen merely as another cyberattack story. It is one of the important examples showing how far AI agents can be used in cyber operations. In this new era of cybersecurity, the question is no longer only: "Will we be attacked?" The real question is: "When an AI-supported attack begins, how quickly can we notice and stop it?" At SecureSys we support organisations in strengthening their cyber resilience against a changing threat landscape, through penetration testing, Red Team, continuous vulnerability management, SOC, SIEM, EDR/XDR, NDR and cybersecurity consultancy services. Test your security against next-generation threats before an attack happens.