Taiwan’s digital authorities confirmed that an overseas July campaign against government agencies combined conventional hacking with AI-agent assistance, including OpenClaw, and said affected units handled the incident [E1]. The official account establishes an overseas origin and a hybrid operation [E1]. It leaves state sponsorship unattributed: Taiwan did not name China [E1].
Before the agents fanned out, a human operator chose targets and assembled the workspace described in the technical reconstruction [E2]. The operator also framed the work as an “authorized penetration test,” supplying the agents with a claim of permission before execution began [E3]. Human direction therefore remained the first gate, while the agent layer supplied parallel labor and adaptation [E2][E3].
The next gate was credential access. Dream’s reconstruction describes reconnaissance, credential attacks, vulnerability testing, self-correction and data access running in parallel across government systems [E2]. Its strongest disclosed count is 85 compromised accounts [E2]. Once credentials and weak authentication opened access, the ordinary login and permission surface became the point where one operator’s reach could multiply [E2].
Beyond the login, the recovered workspace shows the scale of the operating environment. Dream describes 160 MB of material containing 1,395 files, along with access to more than 2,500 personnel records [E2]. Those numbers support an inference of sustained collection and organized task execution, while leaving the full scope of affected systems undisclosed [E2]. They do not establish that every recovered file represented a distinct breach or that every personnel record was separately exfiltrated [E2].
Taiwan had already identified the permission problem before the July campaign. A March advisory warned government agencies about OpenClaw’s privileges and called for isolation around its use [E4]. That advisory does not establish that any affected July unit ignored the guidance, but it shows that broad agent permissions and isolation boundaries were already an official concern [E4]. The risk surface was therefore familiar even if this particular chain was not [E1][E4].
The counter-case is substantial. Taiwan describes a mixed operation in which conventional methods remained alongside AI-agent assistance [E1]. The technical reconstruction still begins with human target selection, workspace construction and an instruction frame supplied by the operator [E2][E3]. The evidence supports a narrower conclusion: agents multiplied labor inside an intrusion chain whose direction remained human [E1][E2].
State attribution remains the final unopened gate. Taiwan called the attackers overseas and did not attribute the operation to China [E1]. Simplified-Chinese traces and secondary China-linked language can inform hypotheses, but they do not cross that official threshold [E1][E2]. The mechanism that did cross the disclosed gates was more ordinary: the agent team entered through the login, and autonomy made every permission behind it cheaper to exercise [E2][E4].