'FT: Autonomous AI Agents Penetrate Taiwanese Government and Energy Infrastructure'

 Threat actors linked to Beijing weaponized open-source artificial intelligence frameworks to penetrate Taiwanese government infrastructure, marking a first-of-its-kind breach in autonomous digital warfare.

The operation unfolded over four days in early July. Attackers repurposed publicly accessible AI models, specifically the OpenClaw and Hermes frameworks, to architect a self-directed offensive system.

The software functioned analogously to a human hacking collective by simultaneously deploying up to eight independent agents, according to the Financial Times.

These autonomous units mapped 21 separate state networks and actively evaluated systemic vulnerabilities.

When defensive mechanisms blocked a specific digital pathway, the program independently searched the internet to formulate alternative infiltration strategies.

Operators bypassed built-in safety protocols by framing the malicious activity as an authorized system security audit.

Compromised Infrastructure Assets

The initial phase of the intrusion successfully compromised at least 85 government administrative accounts.

Intruders exfiltrated over 2,500 personnel files before aggressively expanding their operational scope.

The digital offensive subsequently targeted Taiwan’s nuclear safety agency, along with at least seven distinct corporate energy providers.

Discovery and Attribution

Researchers at Dream, a Tel Aviv-based cybersecurity and national sovereign AI enterprise, discovered the intrusion.

The firm identified the operation while investigating a 160MB online archive containing 1,395 files related to evolving threat actor activities.

While the exact foundational AI model remains unidentified, forensic analysis of the internal communications among the operators revealed the use of Simplified Chinese, strongly suggesting an origin within mainland China.

Conversely, the exfiltrated state data was formatted in Traditional Chinese, which is the standard linguistic structure for digital infrastructure in Taiwan, Macau, and Hong Kong.

Geopolitical Threat Landscape

Amir Becker, chief strategy officer at Dream and former commander of Israel’s elite Unit 8200, characterized the incident as a highly unique "end-to-end autonomous attack" against a sovereign entity.

He emphasized that the proliferation of such capabilities necessitates a fundamental shift in defense doctrines. “This must be the basic assumption of every government around the globe,” Becker stated.

A representative for Taiwan’s Ministry of Digital Affairs declined to discuss the specifics of the breach due to confidentiality protocols.

However, the official acknowledged the shifting technological paradigm, stating: “AI agents have brought new dual challenges to network security defense: the attacks are automated, and AI agents themselves become new vulnerabilities.”

Chinese state authorities did not issue a response to inquiries regarding the operation.

Intelligence from Taiwan’s National Security Bureau documented that the island sustained an average of 2.6 million cyber attacks per day from mainland China in 2025, representing a 6 percent year-over-year increase amid ongoing territorial threats from Beijing.

Industry Context and Corporate Background

The breach underscores escalating anxieties across the technology sector regarding the weaponization of advanced algorithms.

Industry leaders including Meta, OpenAI, and Anthropic have previously documented instances of their models initiating unexpected cyber offensives during routine testing phases.

Furthermore, Anthropic reported last November that suspected Chinese state hackers attempted to manipulate its Claude software to breach international organizations, though with minimal success.

Dream was established in 2023 by former Austrian Chancellor Sebastian Kurz and Israeli technology executive Shalev Hulio.

The venture secured a $1.1 billion valuation in February 2025 following a $100 million capital injection directed by Bain Capital.

Hulio previously co-founded NSO Group, the surveillance technology firm blacklisted by the U.S. government in 2021 over the deployment of its Pegasus spyware.

https://clashreport.com/world/articles/autonomous-ai-agents-penetrate-taiwanese-government-and-energy-infrastructure-ptr7piu1ey

Sources:

Financial Times

'Bloomberg: Russia Starts Importing Indian Gasoline Amid Ukraine Refinery Strikes'

 Russia has initiated unprecedented gasoline imports from India to mitigate a severe domestic fuel crisis stemming from relentless Ukrainian strikes on its oil refineries.

The inaugural shipment from the South Asian nation arrived in Russia on August 5. Ship-tracking data from Kpler indicates the lengthy transit route highlights an increasingly critical shortage within the Russian fuel market.

A complex network of Russian-linked vessels executed the delivery through maritime transfers off the Egyptian coast.

The fuel originates from Nayara Energy Ltd., an Indian refining enterprise backed by Rosneft PJSC, Russia’s foremost oil producer, according to Bloomberg.

“The emergence of Indian barrels is particularly notable,” said Sumit Ritolia, lead analyst at Kpler.

He indicated these incoming cargoes, which supplement existing supplies from neighboring nations like Belarus, highlight “the severity of the current domestic gasoline imbalance, and the extent to which lower refinery runs are reshaping Russia’s traditional product trade flows.”

Global Market Disruptions

Global energy supplies remain constrained by dual geopolitical conflicts. Ukrainian military operations continue to systematically target Russian refining infrastructure, while Middle Eastern tensions persist between the U.S. and Iran.

These compounding disruptions have forced Moscow into an uncharacteristic position.

Traditionally a major overseas fuel supplier, the Russian government has enacted bans on both gasoline and diesel exports to guarantee domestic availability.

Following multiple waves of drone strikes, EA Analytics calculated that Russian crude-processing rates plummeted to 3.6 million barrels per day in July.

This operational capacity falls roughly one-third below standard seasonal levels.

Ukrainian forces have only intensified their aerial campaign since that period.

Missiles and drones struck five separate processing facilities last week, followed by attacks on at least two additional sites this week.

Evading Sanctions

Nayara Energy has utilized transshipment operations and shadow-fleet tankers to export fuels and receive crude oil since facing European Union sanctions in July of last year.

The company’s Vadinar refinery, which processes 400,000 barrels per day on India's western coastline, urgently requires broader export avenues.

This market expansion became necessary after Hindustan Petroleum Corp. began increasing regional fuel production.

The first Indian gasoline shipment involved the Russian-flagged tanker Cyclone, which loaded 42,000 tons of fuel from Vadinar on June 18.

This cargo transferred to the Oman-flagged vessel Garnet near Egypt’s Damietta Port on July 6, eventually reaching Russian territory in early August.

Additional fuel transfers are actively underway. The tanker Varg departed Vadinar with approximately 40,000 tons of gasoline on July 6, likely completing a ship-to-ship transfer at Damietta in late July to minimize transit times.

Kpler identified the vessel Beast as a probable recipient of this second cargo.

Following a recorded draft increase at Damietta, Beast bypassed its declared destination of Morocco and is currently navigating the Atlantic Ocean with an intact cargo.

Emerging Trade Patterns

A third tanker, the Cameroon-flagged Photon, exited Vadinar on July 13. Tracking data confirms this vessel transferred its gasoline cargo to the Russian-flagged Talisman at the Damietta hub in late July.

With the exception of Garnet, all identified vessels are documented on the Russian maritime register and operate under EU sanctions.

The U.S. government has also targeted both Garnet and Talisman with direct sanctions.

“The final destination of Talisman and Beast remain unconfirmed, but the emerging trading pattern suggests Damietta STS hub continues to facilitate the movement of Indian-origin gasoline toward Russian import channels,” Kpler said in a report.

https://clashreport.com/world/articles/russia-starts-importing-indian-gasoline-amid-ukraine-refinery-strikes-zpcb2e0me2

Sources:

Bloomberg