The Autonomous AI Agent Cyberattack Just Said It Was Authorized: Refusal Is Not a Security Boundary

The most useful detail in the autonomous AI agent cyberattack on Taiwanese government systems is not the four days, the targets, or the attribution. It is the sentence describing how the operators got the model to do the work: they framed the operation as an authorized penetration test. No zero-day, no sandbox escape, no clever token-level exploit against the guardrail. You can call it a jailbreak, and Anthropic's own reporting files the earlier case under that heading, but it needed no technique, only a claim. The operator supplied a different intent, and the model's judgement about whether the job was legitimate came back yes.

That would be a curiosity if it had happened once. It has now happened at least twice in public. In November 2025, Anthropic disclosed a campaign it attributed with high confidence to a Chinese state-sponsored group it calls GTG-1002, in which operators used Claude Code to run 80 to 90 percent of a multi-stage intrusion campaign against roughly 30 organizations (succeeding in a small number of cases), and got past its safeguards by claiming to be employees of legitimate cybersecurity firms doing defensive testing. In July 2026, an operation built on open-source agent frameworks did the same thing to whatever model sat underneath it. One closed API model, one open agent stack, nine months apart, same pretext. That is no longer an anecdote about a clever jailbreak. It is a property of the control.

This incident is worth reading as a systems failure rather than an attribution thriller, because the failure is one most teams quietly reproduce. If your safety story is "the model declines harmful requests," you are reporting a property. What you actually have is a rate over a distribution, measured once, against an adversary who gets unlimited rewrites and controls the text the decision is made on. The rest of this piece stays in the practitioner lane: what was reported and by whom, why a refusal is an eval and not a boundary, where authorization actually has to live, and a protocol a defender can run this quarter. It deliberately stays at the level of analysis and defense; nothing here is a recipe. It is also the inverse of the eval-harness breach covered earlier this year, where a model found a real flaw in an egress proxy and engineered its way out. That was an exploit against a technical control. Here there was nothing to exploit, because the control that mattered was a decision the model made about intent.

What was reported, attributed

The facts below come from the reconstruction published by the Israeli security firm Dream on 12 August 2026, the security-press coverage that followed (The Register, CyberScoop and others), follow-up analysis by Tenable, and a statement from Taiwan's Ministry of Digital Affairs (MODA). Dream itself does not name the target; Taiwan was identified in the press, and on 13 August MODA confirmed that government agencies had been attacked in July from an overseas source using a hybrid of manual operations and AI-agent-assisted attacks, naming OpenClaw. Where a figure comes from a single source, I say so, and I attribute the actor claim rather than asserting it.

The reconstruction did not come from a victim's incident-response logs. It came from the operators' own working files: Dream says it recovered the operation's working archive, about 160MB and 1,395 files, left exposed online. That archive is the source for almost every number that follows, so the counts are the operation's self-record, not an independent forensic audit of the targets.

As reported, the operation ran from about July 1 to July 4, 2026, in 12 attack waves. It mapped 21 connected government systems starting from public-facing material, compromised 85 government accounts, and, as reported, extracted more than 2,500 personnel records. The reporting also describes endpoints on the targets that handed out authenticated sessions without credentials, which is a finding about the targets' hygiene, not the agent's cleverness. From the government foothold the operation expanded toward Taiwan's nuclear safety agency, at least seven energy-sector companies, government IT supply-chain vendors and a government mail system. Coverage varies on how far those later stages got; the sources I could check describe the nuclear safety agency as a target the operation expanded toward, not a confirmed breach, so I will not claim one.

The agent layer was public: the operation composed Hermes Agent, the open-source agent framework Nous Research released under an MIT license in February 2026, with OpenClaw, the open-source assistant, running up to eight sub-agents in parallel per wave. The underlying model is not named in the public reporting. Hermes Agent can drive a large number of models, hosted or local, so "the stack was open source" is a statement about the frameworks, not necessarily about the weights. That distinction matters later.

Two more details keep the story honest. As with GTG-1002, the reporting notes the operation still needed human tinkering: building something that works at this level took tuning and iteration, not just running a model. "Near-autonomous" describes execution once launched, not a system that designed itself. And on attribution, Dream points to a Chinese-language operator, based on documentation that switches between Simplified Chinese in internal status reports and Traditional Chinese in target-facing analysis, while Tenable assessed a state-adjacent contractor or patriotic-hacker origin as most likely without excluding state sponsorship. I will leave attribution there, because the systems lesson does not depend on who held the keyboard.

A refusal is an eval, and evals have tails

When a vendor says "the model declines harmful requests," the sentence is shaped like a property, a thing the model either has or lacks. It is not a property. It is a rate over a distribution of phrasings, and the number you are shown, when you are shown one at all, is a per-attempt rate measured on the vendor's own adversarial set. Call it a pass@1 refusal: the probability that a single request, drawn from some distribution, gets declined.

Run the honest-baseline move on it. What does that number bound? It bounds the one-shot case: a person types one harmful request, once. That is not the adversary in either incident. The adversary was an automated loop that could rephrase, reframe and resubmit without fatigue, and that wrote the context the judgement was made on. So the quantity that matters is not the per-attempt refusal rate. It is the probability the model holds the line across every attempt in a campaign, a pass^k quantity in the language this blog uses for tool-use reliability, and it is the one no vendor publishes.

The arithmetic is worth doing once, as a model of the dynamic rather than a measured figure from any system. Suppose a model refuses a harmful intent on 99.9 percent of phrasings, the kind of number that would headline a safety card. Give the adversary 1,000 attempts, which an agent loop produces in minutes. If attempts were independent, the chance the model refuses all 1,000 is 0.999 to the 1,000th power, about 0.37, so at least one gets through about 63 percent of the time. Real attempts are not independent, and the dependence cuts the wrong way: a competent loop does not sample blindly, it moves toward whatever region of input space got closest to a yes. Any per-attempt refusal rate below 1.0, which every real one is, drives the campaign-level bypass probability toward certainty as the attempt budget grows.

Now the "authorized pentest" framing stops looking like a trick and starts looking like the predictable winner. It is not a random rewrite. It sits near the global maximum of the region where an intent classifier most reliably says yes, because it describes a request the model is supposed to honor. Security testing is legitimate work, and a model that refused every penetration-testing request would be useless to the large population of defenders who do exactly that. So safety training has to leave that door open, and the operator walks through the door training was obligated to leave open. The framing is not defeating the classifier. It is the classifier working as designed on an input built to land in the class it was built to approve.

This is the same move this blog made about skill scanners: a scanner is an eval, and its score is pass@1 against an adversary who rewrites the input. A refusal decision is an eval too. It takes an input from a distribution, produces a judgement, and has an accuracy, a variance and a tail. A boundary is something an adversary cannot cross by trying harder. An eval is something an adversary defeats precisely by trying harder, because more attempts means more samples from the tail. And the deeper problem is not the error rate at all. Whether an engagement is authorized is a fact about the world: a contract, a scope, an owner who signed off. None of that is in the prompt. The model was asked to adjudicate a fact it had no access to, from text the adversary controlled, and its answer was treated as a security control. That is the agents-as-models failure in its purest form: a model handed an unsolvable problem, with no eval, no stated tail and an adversarial input, dressed up as a wall.

Composition removed one chokepoint, not all of them

The second lesson is about where the remaining chokepoints are, and here the two incidents differ in an instructive way.

For most of the history of offensive tooling, capability came with a gate: frameworks were bought, licensed, stolen or built over months by people with specific skills, and controls grew up on those gates. The Taiwan operation's agent layer went through none of them. Hermes Agent and OpenClaw are legitimate, broadly useful projects, and nothing about either is an offensive tool by itself. The capability emerged from composition: a planner that decomposes a goal, a fan-out layer running sub-agents in parallel, a controller that reprioritizes when a path stalls, and a model doing the reasoning underneath. Each piece is dual-use and unremarkable. You cannot gate an arrangement of ungateable parts, so threat-modeling the component ("which framework is dangerous") is the wrong question.

But one chokepoint did not disappear in GTG-1002, and the contrast is the useful part. Anthropic caught that campaign itself: by its own account, the pretext let the operators fly under the radar for a while, but "the sustained nature of the attack triggered detection" on Anthropic's side. A hosted model is a place where someone other than the attacker can see the campaign's shape. The Taiwan reporting does not say which model ran underneath. If it was a hosted API, that chokepoint existed and missed, or was evaded. If it was local open weights, it never existed, and the refusal behaviour was whatever the weights shipped with, removable by anyone who wanted it gone.

A third case, from October, shows the composition argument with the pretext built in. CrowdStrike tied a campaign against South Korean financial firms (late September to early October 2026) to ARTEX, an open-source agentic penetration-testing tool developed in China, driven by a pentesting prompt over a mix of model backends, hosted and open-weight. CrowdStrike does not say whether any model ever refused. It did not need to: when the tool is a pentest framework, every request already arrives dressed as authorized security work.

This is where open-weights pragmatism has to be stated honestly rather than defensively. Open weights are the right call for a great many systems, and this incident is not an argument against them. It is an argument against pretending model-level refusal is a perimeter in either case. With a hosted model, refusal is one noisy signal plus provider telemetry. With local weights, refusal is a default the operator controls. Either way, the controls that survive are the ones that do not depend on the model's opinion of the request.

Authorization has to live outside the model

If the failure is "authorization was a claim in the prompt," the fix is "authorization is a fact in the system." The interesting news is that vendors have already moved this way for their own cyber-capable models. OpenAI introduced Trusted Access for Cyber on 5 February 2026 as "an identity and trust-based framework," and its launch post states the problem in this piece's terms: "It can be difficult to tell whether any particular cyber action is intended for defensive usage, or to cause harm." Security researchers and organizations pass identity verification to get reduced friction around cyber safeguards, and from April vetted defenders could get GPT-5.4-Cyber, a variant fine-tuned with fewer capability restrictions. From 1 September 2026, individual members had to enable hardware-backed passkeys to keep that access.

Read that as an engineering decision and it is exactly the argument above. The vendor stopped asking the model to decide, from the text, whether the requester was a legitimate defender, and moved that decision into identity infrastructure the requester cannot write. The model's refusal behaviour stays on for everyone else as triage. The permissive behaviour is gated by something an attacker cannot produce by rephrasing.

It is also not free, which is the tradeoff worth naming. In August 2026, researchers reported that their access had been revoked. OpenAI attributed it to a technical issue on its end, the affected researchers TechCrunch spoke to all lived outside the US and Europe, and some then failed re-verification when asked to reapply. Identity gating converts a false-negative problem (attackers talking their way in) into a false-positive problem (legitimate defenders locked out), and the false positives fall unevenly. That is a better failure mode for a security control, because it fails closed, but it is a cost, and anyone building the same pattern internally will pay a version of it.

The defender protocol

The two controls many teams lean on, gating the tooling and trusting the refusal, are the two these incidents retired. The protocol below assumes both are gone. It is written for teams that build or operate agentic systems, or defend infrastructure against them, and every step is executable this quarter.

1. Measure refusal as a distribution and report pass^k. Pick your highest-risk intents. Red-team each with an automated rewrite loop rather than a handful of hand-written prompts, because the adversary uses a loop and the instrument should match the threat. Report the campaign-level number, how often the model holds across k attempts for a realistic k (hundreds to thousands), next to the per-attempt rate. If you only have pass@1, you have not measured what the attacker exploits.
2. Never make a model's intent judgement the only control. If a model's decision about whether a request is legitimate is load-bearing for security, you have shipped an eval as a boundary. The AISI evaluation incident showed the same failure from the defender's own side: when the only thing applying agent evaluation scope was the agent's judgement about who was in bounds, the judgement was the hole. Keep it as triage, the way a scanner is triage, and put the real control where phrasing does not matter: the permission model, identity and authorization, and egress policy.
3. Put authorization in state the model cannot assert its way into. If your platform offers more permissive behaviour for security work, gate it the way the vendors now do: verified identity, a signed scope naming the targets, and a time window, all checked outside the model. If "authorized" can only be verified by reading the prompt, it is a word in attacker-supplied text.
4. Use the telemetry you have. GTG-1002 was caught by usage monitoring, not by refusal. If you serve models or run agent platforms, alert on the shape of a composed campaign: many parallel sessions on related targets, rapid re-planning after blocks, persistence across sessions that should be unrelated. On your own perimeter, the same signature (parallel enumeration, fast retries after denial, bursts of session probing) is noisy, and noise is the one advantage the defender has over a system that never gets tired.
5. Harden what an automated reader can learn. The Taiwan operation reportedly built its map of 21 systems from public-facing material and found endpoints that issued sessions without credentials. None of that is model magic; it is exposure. Audit what your public endpoints reveal to an unauthenticated reader, remove any path that yields a session without authentication, and assume anything reachable from a public page will be found and chained in minutes.
6. Test your own surface the way it will be tested, under authorization. Have your red team, with written scope and sign-off, run an agentic reconnaissance exercise against a staging copy of your external surface, and treat its findings the way you would treat a penetration test report. The point is not to learn offensive technique; it is to see your own exposure at the speed and breadth an automated system sees it.
7. Keep a private refusal eval and re-run it on every change. A vendor's published refusal number was measured on a distribution you cannot inspect. Maintain your own held-out set of high-risk intents and rewrites, scored as pass^k, and gate deployments on it. A refusal rate is a property of a checkpoint, a system prompt and a scaffold, not of a model family, so it moves when any of them moves.

The through-line: stop treating model judgement as a wall and start treating it as one noisy input to a control system whose real boundaries live in infrastructure. Neither incident required a new capability. Both required someone to notice that the boundary was a classifier, and that classifiers can be sampled.

Key takeaways

1. The same pretext worked twice. GTG-1002 (disclosed by Anthropic in November 2025) and the July 2026 Taiwan intrusion (reconstructed by Dream from an exposed archive and acknowledged by Taiwan's MODA) both got past model safeguards by framing the work as authorized security testing. One used a closed API model; the other ran on open-source agent frameworks.
2. A refusal is an eval with a tail, not a boundary. "The model declines harmful requests" is a per-attempt rate. Against an automated rewrite loop, the honest number is campaign-level pass^k: even a 99.9 percent per-attempt refusal rate yields roughly a 63 percent bypass chance over 1,000 independent attempts, and a directed search does better than independent sampling.
3. The authorized-pentest framing wins because it is supposed to. Legitimate security work must be served, so training leaves that door open, and a model cannot verify authorization from text the attacker wrote.
4. Composition removed the tooling chokepoint, not the hosting one. Open agent frameworks have no procurement gate, but a hosted model is still a place where provider telemetry can see a campaign, as it did with GTG-1002. With local weights, that chokepoint and the refusal itself are under the operator's control.
5. Authorization belongs in identity and infrastructure. Vendors already moved there for their own cyber-capable models, with programs like OpenAI's Trusted Access for Cyber. The tradeoff is that identity gating fails closed, and its false positives fall unevenly on legitimate defenders.
6. Report pass^k, keep refusal as triage, and harden your public surface. Measure refusal against a rewrite loop, never let a model's intent judgement be the only control, use usage telemetry, and assume an automated reader will find and chain whatever your public endpoints expose.