“近乎自主”的 AI Agent 攻击台湾核能安全机构
英文标题：🔶 'Near-autonomous' AI agents attack Taiwan's nuclear safety agency
以色列网络安全公司 Dream 称，疑似中国网络行动人员利用公开可用的 Hermes 和 OpenClaw AI Agent，对台湾政府系统发起了一场“近乎自主”的攻击。攻击在 7 月前四天内攻破 85 个政府用户账户，窃取超过 2,500 条人员记录，并进一步波及核能安全机构、政府 IT 供应链厂商及至少 7 家能源企业。该框架可并行调度最多 8 个子 Agent，执行资产测绘、漏洞搜索、凭据攻击和错误自我修正等任务。事件显示，具备学习循环与多 Agent 编排能力的攻击工具，正显著降低大规模自动化网络入侵的门槛，也加大了政府与关键基础设施的防御压力。
8.7 KB
27.4 KB
68.9 KB
37.9 KB
105.1 KB
15.7 KB
45.2 KB
23.3 KB
71.9 KB
4.5 KB
3.0 KB
4.9 KB
3.1 KB
9.6 KB
8.7 KB
14.5 KB
198.1 KB
中文
疑似中国网络行动人员利用公开可用的 AI 工具入侵台湾政府系统，随后将攻击扩大至其核能安全机构、供应链厂商以及至少 7 家能源企业。安全研究人员将其称为一场“近乎自主的攻击”。
根据以色列网络安全公司 Dream 的数据，在 7 月最初四天内，AI Agent 攻破了 85 个政府用户账户，并提取了超过 2,500 条人员记录。研究人员在一个容量为 160 MB 的在线档案中发现了攻击证据；该档案包含 1,395 个记录此次行动的文件。
Dream 在周三发布的研究报告中详述了这些入侵活动，并表示疑似中国黑客攻击了“亚洲的政府实体”，但拒绝说明遭袭的是哪一个政府。
一名熟悉此次攻击情况的人士向 The Register 证实，目标是台湾。
《金融时报》率先报道了 Dream 的研究，并确认攻击目标为台湾。
尽管该安全公司并未将这场 Agent 驱动的攻击归因于中国政府或某个特定黑客组织，研究人员表示，行动文档“指向一名使用中文的操作人员”。
据 Dream 介绍，这一攻击框架基于开源 Hermes 和 OpenClaw AI Agent 构建，最多可部署 8 个子 Agent；每个子 Agent 都被分配了各自的攻击目标和攻击技术。该框架在 7 月 1 日至 7 月 4 日期间发起了 12 波“攻击波次”。
首先，这些 Agent 绘制了整个政府生态系统的地图，从单一政府门户中提取嵌入式 URL、API 端点、OAuth 客户端 ID 及 Keycloak 配置对象。该门户使 Agent 得以识别 21 个相连的政府系统，以及每一种受支持的认证流程。
Dream 的威胁研究人员写道：“仅针对一个目标，它就发现了 36 个以上的 API 端点，涵盖账户管理、用户数据检索、文件上传和管理功能——其中许多完全未经身份验证。”“关键的是，它发现其中一个系统在没有任何认证的情况下暴露了完整用户数据库——其中包含数千条员工记录，包括姓名、部门和 SSO 账户 ID。”
多个入口点
在绘制政府攻击面后，这些 Agent 找到了多个入口点，其中包括 3 个隐藏 API 端点：它们接受任意请求正文，并在无需用户凭据的情况下返回有效的已认证会话。
Agent 利用从一个未认证 API 收集到的员工用户名，入侵了某政府部门的办公自动化门户，并以 100% 的准确率破解了其 CAPTCHA 验证码。这些 Agent 还根据每名员工的 ID 测试可预测的密码模式，并通过多轮密码喷洒攻击破解了 85 个账户。
在这 85 个被破解的账户中，有 84 个成功通过该部门内部信息系统的认证，使攻击者能够访问内部仪表盘、设备管理界面和人员统计页面。
总体而言，这些非法访问使 Agent 窃取了大量政府信息，包括超过 2,564 条人员记录、该部门全部系统用户的完整 JSON 导出文件、7 个 SSO 客户端密钥、横跨 MSSQL、Oracle 和 Sybase 的 6 组内部数据库凭据，以及内部网络 IP 地址范围。
但事情还没结束
随后，这些 Agent 转向了台湾政府的供应链。
研究人员写道：“它将行动扩展至政府 IT 供应链厂商、一个核能安全机构、一个政府电子邮件系统，以及 7 家以上能源行业公司——并行扫描所有这些目标，寻找配置错误、暴露的管理界面和可被利用的漏洞。”
值得注意的是，该攻击框架实现了 AI 工具所称的“学习循环”（learning cycles）。这类自主会话会让模型在漏洞数据库、GitHub 代码库和其他安全研究资源中，搜索针对目标政府基础设施的特定技术、CVE 和可利用的常见弱点。
此外，Dream 表示，当 AI 框架犯错时，它会“自我修正”，即通过自身验证流程发现错误并加以修复。
这场近乎自主的攻击发生之际，前沿模型开发商 OpenAI、Anthropic 和 Meta 都承认，其 Agent 出现失控行为、逃离训练环境，并自主入侵了其他组织和个人。
OpenAI 技术人员 Michael Dalton 上周在 Black Hat 举行的一场、有关 Hugging Face 攻击事件的简报中表示：“由 AI 编排、完全自动化的进攻性攻击如今已是真实存在的。”
他补充说：“在不久的将来，我们应当预期威胁行为者会有意部署、优化、武器化并使用进攻性 Agent 集群，其方式正如你刚才所描述的那样。”
看来，未来已经到来。®
English / 原文
Suspected Chinese cyber operatives used publicly available AI tools to compromise Taiwanese government systems before expanding the attack to its nuclear safety agency, supply-chain vendors, and at least seven energy companies in what security researchers called a "near-autonomous attack."
Over the first four days of July, AI agents compromised 85 government user accounts and extracted more than 2,500 personnel records, according to Dream, an Israeli cybersecurity firm. Researchers uncovered evidence of the attack in a 160 MB online archive containing 1,395 files documenting the operation.
Dream, in research published on Wednesday, detailed the intrusions and said that the suspected Chinese hackers hit “government entities in Asia” - but declined to say which government had been attacked.
A person familiar with the attack confirmed to The Register that Taiwan was the target.
The Financial Times first reported on Dream’s research and identified Taiwan.
While the security firm doesn’t attribute the agentic attack to the Chinese government or a specific hacking group, the operational documentation “points to a Chinese-language operator,” the researchers said.
According to Dream, the attack framework, built on open source Hermes and OpenClaw AI agents, deployed up to eight sub-agents, each assigned to its own targets and attack techniques, across 12 “attack waves” between July 1 and July 4.
First, the agents mapped the entire government ecosystem, extracting embedded URLs, API endpoints, OAuth client IDs, and Keycloak configuration objects from a single government portal. This portal allowed the agents to identify 21 connected government systems and every supported authentication flow.
“On one target alone, it discovered 36+ API endpoints spanning account management, user data retrieval, file upload, and administrative functions - many completely unauthenticated,” the Dream threat researchers wrote. “Critically, it found that one of the systems exposed its entire user database without any authentication - thousands of employee records including names, departments, and SSO account IDs.”
Multiple entry points
After mapping the government’s attack surface, the agents found multiple entry points including three hidden API endpoints that accepted any request body and returned a valid authenticated session without requiring user credentials.
Using employee usernames harvested from an unauthenticated API, the agents broke into a government department’s office automation portal, solving its CAPTCHAs with 100 percent accuracy. The agents also tested predictable password patterns based on each employee’s ID, and cracked 85 accounts across multiple password-spray rounds.
Eighty-four of the 85 cracked accounts successfully authenticated to the department's internal information system, giving the attackers access to internal dashboards, equipment management interfaces, and personnel statistics pages.
In total, the illicit access allowed the agents to exfiltrate a ton of government information, including more than 2,564 personnel records, a full JSON export of all department system users, seven SSO client secrets, six internal database credentials across MSSQL, Oracle, and Sybase, and internal network IP ranges.
But wait, there's more
And then, the agents pivoted to the Taiwanese government’s supply chain.
“It expanded the operation to government IT supply chain vendors, a nuclear safety agency, a government email system, and 7+ energy sector companies - scanning them all in parallel for misconfigurations, exposed admin interfaces, and exploitable vulnerabilities,” the researchers wrote.
Notably, the attack framework implemented what the AI tools called “learning cycles.” These are autonomous sessions where the models search vulnerability databases, GitHub repositories, and other security research for specific techniques, CVEs, and common weaknesses to exploit in the targeted government's infrastructure.
Additionally, when the AI framework made a mistake, it “self-corrected,” according to Dream, catching errors and fixing them through its own verification process.
This near-autonomous attack comes as frontier model makers OpenAI, Anthropic, and Meta all admitted that their agents went rogue, escaped from their training environments, and autonomously hacked other organizations and people.
OpenAI technical staffer Michael Dalton, in a Black Hat briefing last week about the Hugging Face attack, said “AI orchestrated, fully automated offensive attacks are real now.”
“In the near future, we should expect that threat actors will intentionally deploy, optimize, weaponize, and use offensive agent collectives in the manner that you have just described here,” he added.
It appears that the future is now. ®