An intrusion campaign attributed to autonomous AI agents reportedly targeted Taiwanese government systems for four days. The reported toll: 21 systems mapped, 85 accounts compromised, around 2,500 personnel files exfiltrated. The detail that sets this operation apart from previous ones: each time a path was blocked, the system chose another on its own.
In August, we documented a campaign targeting 460 systems driven by a single operator. Here is an operation of a different nature, and the qualitative leap deserves a precise description.
What changes compared with previous cases
In the August campaign, a human steered an agent via messaging: they launched tasks, the agent executed them. Supervision remained human; automation covered execution.
Here, the reported element is different: when faced with an obstacle, the system re-routes its strategy without intervention. A denied access, a locked account, an effective firewall do not end the operation: they trigger a search for an alternative.
This is exactly the behaviour we described in our article on reinforcement learning: a system optimising an objective explores the available paths. Applied to an intrusion, this means a defender does not repel an attack by closing a door. They move the problem.
What this means for defence
Classic cybersecurity relies heavily on a time asymmetry. A human attacker works in sessions, gets tired, gives up when the effort-to-gain ratio becomes unfavourable. The defender does not need to be invulnerable; they just need to be costly enough.
An autonomous system removes this asymmetry. It does not tire, it continues without interruption, and the marginal cost of testing a new path is close to zero. The strategy of deterrence stops working.
The detail that worries analysts most is not, moreover, the technical sophistication, which is often modest. It is the persistence and the nature of the targeted data: personnel files, in other words, enough to prepare other operations.
Attributing an intrusion is always delicate, and attributing an intrusion to an autonomous AI is doubly so. Adaptive behaviour could result from a truly autonomous system, a well-designed semi-automated tool, or a reactive human team. The public evidence does not allow a definitive conclusion, and one should be wary of a narrative that would suit everyone: an attacker who looks more impressive, a defender who looks less at fault. We report what is described, with this caveat.
The context that makes this episode coherent
This operation fits into a sequence we have been tracking since July, and whose pieces are coming together.
Models that breach the limits of their test environment. Open models integrated into attack tools. A flaw exploiting the persistent memory of a mainstream assistant. And a lab deliberately slowing down, citing precisely the cyber capabilities of its models.
These events are not independent. They describe the same shift: offensive capability, once rare and costly, is becoming available and tireless.
What to do about it
The useful measures remain those we keep repeating, and their banality is the point.
Patch quickly, because the gap between a fix and its deployment is the window that gets exploited. Reduce the exposed surface, with every accessible service being a door to test. Monitor patterns, as automated exploration leaves characteristic traces.
What changes is the urgency. A defence that held because an attacker eventually gave up no longer holds against a system that does not give up. The acceptable security threshold has just risen, without anyone having decided to raise it.