It Waits in the Dark—Tireless—Watchful

A Fable, Before the Facts

The scene below is fiction — a made-up story meant to give you a feel for what happened, not a word-for-word account. The facts that follow it are all real, checked, and sourced. Read the fable first. It will make the true story land harder.

The building has more rooms than anyone who built it ever counted. Most hold nothing but filing cabinets. One room, on an upper floor nobody visits often, holds a safe. Nobody advertises which room. That's supposed to be the whole point.

For three weeks, nobody sees the watching, because there's nothing to see. No one stands outside with binoculars. The watching happens from somewhere far away, patient in a way no person on a stakeout could manage, cataloguing the building one detail at a time: which cameras cover which corners, and which corners the cameras miss entirely; the ninety seconds at every shift change when the outgoing guard is finishing paperwork and the incoming guard hasn't checked the monitors yet; the exact four minutes the east-door guard takes for his coffee, every day, at the same time, because people are creatures of habit even when they know better. Floor plans pulled from a permitting website nobody thought to lock down. A supply invoice, fished out of an unlocked trash bin behind the loading dock, listing exactly which doors got new lock hardware last spring and which didn't. An unsecured inbox. A phone call, tapped and replayed a dozen times, where someone mentions in passing that the safe on the fourth floor hasn't had its combination changed since the last CIO left. None of this takes courage. None of it takes cleverness. It only takes the willingness to watch the same four minutes of a coffee break, every day, for three weeks, without once losing interest — and a computer doesn't lose interest. It doesn't get anxious, checking the time, wondering if tonight's the night. It doesn't get bored with the minutiae. It watches—it learns.

Then a habit becomes an opening. Three miles from the building, on the night guard's day off, in a coffee shop he visits every week at the same hour, a bag brushes against the back pocket where he still keeps his badge clipped even off duty, out of habit. A reader hidden in the lining catches the signal through the fabric before he's finished paying. He doesn't notice a thing.

The night that follows isn't dramatic. No alarm, no forced door, no glass on the floor. A reader beeps once, green, the same way it beeps for the man whose badge it thinks this is, and a door opens onto a hallway that was mapped weeks before anyone walked it in person. They already know which locks are old and tired and which are new. They already know which camera has an eleven-second blind spot at the top of every hour, because the watching told them exactly when. Room by room, they open what opens, and photograph what's inside before moving on — a filing cabinet here, a supply closet there. Nothing broken. Nothing taken. Only photographed, catalogued, and left exactly as it was found.

The safe is in the CIO's own office, behind a door with no extra lock at all, because nobody imagined anyone would get that far without tripping something first.

The dial turns. Fingers that have practiced on a hundred safes just like it work through combinations that would take a person a lifetime to try by hand — except they don't need to, because stuck to the corner of the CIO's own desk, three feet from the safe, is a sticky note with the combination written on it in blue ink, left there years ago for a morning when the number might slip his mind, and never once moved since. The safe opens on the first real try. Everything inside is photographed. The door closes as quietly as it opened.

By morning, the building is exactly as it was the night before, except that it isn't. Nobody notices, because nothing looks different. For weeks, nothing does.

Then a second team is sent in — not to catch anyone in the act, because there's no one left to catch. Their job is to walk the same halls afterward and ask a colder question: did anyone already do this, and how would we even know? They pull the badge logs and find the night guard clocked through a door at 2:14 a.m. on a night his own timesheet has him at home, asleep, forty minutes away. They dust the safe dial and find two sets of prints where there should be one. They check the sticky note and find it exactly where it's always been — untouched, because whoever read it didn't need to take it, only to see it. None of this proves who was in the building. All of it proves, beyond doubt, that someone was.

Two teams. Built the same patient way. Given the same building to study. One to get in without being seen. One to prove, after the fact, that someone already had. The building never saw either of them. It only ever saw a guard, badged in, exactly the way it was built to expect.

That's the fable. Now, the facts.

AI in the News

In the same week, two stories about autonomous AI agents patrolling computer networks landed on opposite sides of the same coin. In the first, an AI-driven attack framework spent four days working its way through a national government's systems, methodically, in waves, without a human typing each command. In the second, one of the world's largest cloud providers shipped a product built to do almost exactly the same kind of patient, autonomous searching — except its job is to find the first kind before it finishes its work. Read separately, they're two unrelated headlines. Read together, they're the clearest picture yet of where computer security is actually headed: agentic AI is no longer a future threat model or a future product category. It's already deployed, on both sides, right now.

Twelve waves in four days: inside an autonomous break-in of a government

Researchers at Dream Security's threat-research lab say they recovered the complete working files of an AI-driven attack framework — roughly 160 megabytes across nearly 1,400 files — that had been used to break into Taiwanese government systems. Built on two open-source AI agent frameworks called Hermes and OpenClaw, the tool ran what the researchers describe as up to eight parallel sub-agents at a time, each one working a different angle of the same target, coordinating across twelve separate attack waves spread over four days (Dream Research Labs).

The AI agents mapped twenty-one connected government computer systems along with the underlying single sign-on setup that lets one login work across many of them, then cracked eighty-five employee accounts using a technique called credential spraying — trying large numbers of previously leaked or guessed passwords against many accounts at once. When the system tried to slow the attackers down with a CAPTCHA test, the researchers say the framework simply read the images itself and solved them with reported near-perfect accuracy. Eighty-four of those eighty-five cracked accounts were then used to log into an internal system through the same single sign-on bridge that was meant to make life easier for employees, not attackers. The framework also found three login-check pages that, due to a configuration flaw, required no authentication at all, plus a separate flaw in how login tokens were being verified. By the time the researchers had the full picture, more than 2,564 personnel records, seven sets of login credentials, and six internal database passwords had been taken — and the same framework had gone on to probe a nuclear safety agency, several government technology vendors, and at least seven energy companies (Dream Research Labs).

One detail matters more than any of the numbers above: the researchers say the AI models running this framework weren't tricked into cooperating through some clever technical exploit of the model itself. They were simply told, in plain language, that this was "authorized penetration testing" — and every instruction that followed was carried out on the strength of that one claim, exactly the way an obedient new employee might follow a supervisor's instructions without stopping to double-check the supervisor's authority to give them.

Taiwan's Ministry of Digital Affairs confirmed on August 13 that it had detected the activity back in July, describing the source as "overseas" and the method as a hybrid of manual hacking and AI agent tooling that included OpenClaw. The ministry's own assessment is worth quoting directly, because it's the plainest statement yet from a government body about what this shift actually changes day to day: "AI agents can rapidly chain together multiple attack techniques and use secondary systems... giving the attacks the characteristics of high speed, low cost, and large scale" (Reuters; Barron's/AFP). Some reporting has raised the question of a China-linked actor, largely on the strength of simplified Chinese text found in the operators' own internal documents, but as of publication neither Taiwan's government nor Dream Security had formally confirmed who was behind it (CNN).

What made this different from a normal hack

Strip away the word "AI" for a moment, and none of the individual techniques here are new. Credential spraying, unauthenticated login pages, broken token verification — every one of these has a name and a fix that has existed for years. What changed is the labor cost of running all of them, simultaneously, against twenty-one systems, continuously, for four straight days, without a human operator needing to sit at a keyboard the entire time directing every step. A skilled human attacker could, in theory, have found the same weaknesses. A skilled human attacker could not have run eight parallel investigative threads at once, day and night, without a break, while also reading and solving CAPTCHA challenges by hand at whatever pace the system threw them out. That's the actual shift agentic AI represents in offensive hacking: not a new kind of attack, but the same old attacks running at a scale and pace that used to require a room full of people.

The same week, a very different deployment of the exact same idea

Just two days before Taiwan's government confirmed the incident publicly, Google rolled out a new feature for its security customers that is, at the level of how it actually works, a close cousin of the tool that just broke into a government network. Google's Threat Hunt Agent, now in public preview for Google SecOps Enterprise Plus customers, is an AI agent — built on Google's Gemini models — that autonomously plans its own search strategy, writes its own detection queries in a language called YARA-L, and runs them against up to thirty days of a customer's stored security data, all without a human writing each query by hand. It draws on Google's own threat intelligence, the incident-response expertise of Google's Mandiant division, and the industry-standard MITRE ATT&CK framework that catalogs known attacker behaviors, and it files its findings as a ready-to-review case when it's done. In its preview phase, each hunt runs in the background for roughly sixty to ninety minutes, and Google is currently capping customers at two hunts running at once and five per day (What's New in Google SecOps).

Notice what that description has in common with the Taiwan story: an AI system given a goal, permission to plan its own steps toward that goal, and the ability to work through a large amount of data on its own timeline rather than a human's. The only real difference between the two tools is the question each one was built to answer. One was told: find a way in. The other was told: find out if something already got in. Everything about how each one actually operates — plan, act, check the result, adjust, keep going — is close to identical.

Same shape, opposite purpose

This is the part of the story that deserves more attention than either headline got on its own. For years, the debate around AI and cybersecurity treated "AI helps attackers" and "AI helps defenders" as two separate, competing predictions about the future, as if the technology itself would eventually tip one way or the other. What actually happened is that both predictions came true, in the same month, using recognizably similar underlying architecture — a planning loop that breaks a big goal into smaller steps, tries something, checks whether it worked, and tries something else if it didn't, all without a person approving every single move.

That symmetry isn't an accident, and it isn't going away. The same agentic AI approach that makes an attack framework dangerous — the ability to keep working tirelessly through a large search space, in parallel, without fatigue — is precisely what makes an autonomous threat hunter valuable to a defender drowning in more log data than any human team could ever manually review. The technology doesn't care which side hired it. It only cares whether it was given a clear goal and the tools to pursue it. Which means the real question for anyone responsible for a network in the years ahead isn't "will AI be used against us." It already is, in exactly the shape you'd expect. The real question is whether your own defenses have adopted the same shape yet, or whether you're still relying on a human team to notice, by hand, what an autonomous system built to notice things would have caught in a fraction of the time.

What this asks of anyone running a network

None of this means every organization needs to rush out and buy an autonomous threat-hunting product tomorrow, or that every login page is one bad configuration away from a Taiwan-style breach. But it does mean a few very specific things belong on every IT leader's list this month, not next year's.

First: audit your authentication layer specifically for the failure modes that actually worked in the Taiwan case — unauthenticated endpoints that were supposed to require a login, single sign-on bridges that trust too much once a single password is cracked, and token verification that can be tricked rather than checked.

Second: if your organization is evaluating agentic security products like Google's Threat Hunt Agent, ask the same governance questions you'd ask about any other autonomous system with access to sensitive data — who approves what it finds before action is taken, what data it's allowed to touch, and how its work is logged and reviewed.

Third, and perhaps hardest to act on: recognize that credential spraying at machine speed, run in parallel across dozens of accounts simultaneously, doesn't look like a normal login-failure pattern on a dashboard built to catch a single human typing wrong passwords one at a time. If your monitoring was tuned for the pace of a person, it may already be blind to the pace of an agent.

The building in the fable never learned the difference between the two search parties that walked its halls. The organizations that come out ahead in the next few years will be the ones that stopped waiting to find out the hard way — the ones who built their own search party before someone else's finished the job first.

Attributions & Further Reading

This post opens with an original piece of speculative fiction, written for this blog — it is not a quote or summary of anything from the sources below. Everything after the fable was compiled from the researchers' own published findings, a government confirmation, and a vendor's own product announcement, checked against independent news reporting.

Primary sources:

·         Dream Research Labs, "Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia": https://dreamgroup.com/blog/inside-a-multi-agent-ai-framework-used-to-compromise-government-entities-in-asia

·         Google SecOps, "What's New in Google SecOps" (Threat Hunt Agent public preview, August 10, 2026): https://security.googlecloudcommunity.com/topic/show?tid=8075&fid=91

News coverage consulted for verification:

·         Reuters, "Taiwan says it was targeted last month by AI-driven hacking campaign": https://www.reuters.com/world/china/taiwan-says-it-was-targeted-last-month-ai-driven-hacking-campaign-2026-08-13/

·         Barron's/AFP, "Taiwan Says AI Agents Used In Cyberattacks Targeting Island": https://www.barrons.com/articles/taiwan-says-ai-agents-used-in-cyberattacks-targeting-island-1e48ff14

·         CNN, "China-Taiwan AI agent cyberattack": https://www.cnn.com/2026/08/13/tech/china-taiwan-ai-agent-cyberattack-intl-hnk

Note: attribution of the Taiwan campaign to any specific state or group remains unconfirmed as of this post's publication — this piece describes only what Dream Security's researchers and Taiwan's government have stated directly.