The synthetic employee on your network: what the Taiwan agentic attack means for DORA and NIS2 compliance

On 12 August 2026, the Israeli firm Dream published the reconstruction of a campaign that, over four days in early July, compromised government systems in Taiwan using a framework built from open-source AI agents, Hermes and OpenClaw. The figures were picked up across the security press: 21 systems mapped, 85 accounts cracked, over 2,500 personnel records exfiltrated, a pivot to the nuclear safety agency and seven energy companies. Taiwan’s Ministry of Digital Affairs confirmed it publicly the next day.

The headlines sold the incident as the “first fully autonomous attack on a government”. That is sensational framing, and it deserves defusing up front. Exactly where the press exaggerates, a CISO gets the chance to see the real risk clearly — a risk that is better anchored and more data-driven than the panic.

This article doesn’t retell the incident. It uses it as a starting point for a question no one is yet asking in compliance terms: what happens when tens of thousands of organisations and individuals already run, voluntarily, the same class of software that was weaponised in Taiwan — and none of them knows how well it is isolated?

What Taiwan actually was, and what it wasn’t

The Dream report consistently uses the term near-autonomous, not fully autonomous. The difference isn’t cosmetic. The framework needed a two-layer Bayesian scoring engine and cross-verification across several rounds of independent agents precisely because LLM agents are unreliable: they drift, hallucinate, report false positives. The operation’s final summary explicitly lists seven false positives alongside the confirmed vulnerabilities, including a supposed SQL injection “proven” by a 21-second delay that turned out, on retest, to be an SMTP timeout.

The exploited vectors weren’t new either: debug endpoints left in production, JWT tokens accepted with the alg field set to none, unauthenticated APIs exposing whole user databases, SSO that blindly trusted sessions, passwords predictably derived from the employee ID. Every one of these weaknesses is more than ten years old.

The sober conclusion: the AI invented no vulnerabilities. It compressed the time between reconnaissance and exploitation. What a human red team does in weeks, the framework ran in four days, across 14 attack chains in parallel, adapting to blockers through autonomous research cycles. The threat isn’t superhuman intelligence. It’s the collapse of the marginal cost of a competent attack, sustained at a scale and speed impossible for human operators.

That is the verifiable part. The rest of the article proceeds from here.

Why it isn’t “a DDoS with a different impact”

The intuitive analogy is the classic IoT botnet, Mirai — the compromised surveillance cameras that took down entire services. The analogy captures the skeleton correctly: unhardened, distributed nodes, commanded from outside, amplifying an effect through numbers. But it breaks exactly at the point that matters for a regulated environment.

A Mirai node is dumb. It sends packets. It amplifies a single dimension, bandwidth. A compromised agentic node amplifies four dimensions at once, and only the first is present in Mirai:

• Node multiplier. N independent sources. That’s all a classic botnet offers.
• Capability multiplier. Each node runs with the victim’s identity. It has a shell on the host, browser sessions with valid cookies, API keys and local credentials. A camera sends unauthenticated packets. A compromised agent can log into applications, read the mail, sign, initiate transactions — all as a legitimate user. It’s like hiring someone who already has your badge, your password and your signing authority.
• Cognitive multiplier. Each node reasons, researches new techniques when blocked, self-corrects. The botnet is no longer a cannon. It’s a distributed red team that doesn’t sleep.
• Attribution dilution. The actions come from thousands of residential IPs belonging to innocent people, each with a legitimate behavioural fingerprint. Attribution — already fragile in Taiwan, where all Dream could say was that the documentation pointed to a Chinese-speaking operator — becomes almost impossible.

Mirai captures only the first dimension. The serious part is the combination of the other three: a distributed, authenticated and adaptive workforce that the legitimate owner no longer controls.

The mechanism, honestly, including where it breaks

So this isn’t speculation, it’s worth following the chain end to end, with the weak points stated.

Initial compromise generalises nicely. The universal vector isn’t a CVE, it’s indirect prompt injection. The agent reads your mail; an attacker sends you a mail with injected instructions. The agent browses a page; the page contains a payload. The vector is agnostic to the base model, the configuration, the installed skills. That resolves the limitation that kept Mirai captive to homogeneous devices: the agentic fleet is heterogeneous, but the key — hostile natural language — gets in everywhere the same way. On top of that, the supply chain: trojanised skills from community registries, package slopsquatting — exactly the risk class ENISA has already flagged on npm and PyPI.

Persistence is worse than Mirai’s, not better. Mirai dies on reboot, because it lives in RAM. An OpenClaw-type agent stores its memory as text files on disk, and a heartbeat mechanism wakes it up on a schedule. A single successful injection writes persistent instructions into the agent’s memory. The heartbeat re-executes them every cycle. Persistence doesn’t need an implant. It needs a text file. The one piece of defensive good news is that the file is human-readable, hence inspectable — if someone knows where to look.

Command-and-control doesn’t need building. This is the elegant and unpleasant part. An agent that lives inside messaging apps inherits those channels as C2 infrastructure. Encrypted traffic, hard to block, indistinguishable from normal activity. The attacker stands up no servers. They inherit the agent’s communications.

Where the scenario breaks. Analytical honesty requires saying this too, otherwise a sceptical CISO takes it all apart in two minutes. Coordination at scale is hard: Taiwan used eight agents and still needed probabilistic scoring and repeated cross-verification, because LLM nodes produce noise. Ten thousand unstable agents produce, mostly, garbage. Deconflicting and aggregating results across non-deterministic nodes is a real engineering problem, not solved by “more nodes”. Cost leaves traces: each capable node burns inference, and if the attacker uses your API key, it creates a cost spike and rate limits — a detectable signal. Local models avoid the signal, but are weaker. And it’s noisy: unlike a silent IoT implant, an agent doing strange things writes files, opens processes and, critically, talks on channels.

The synthesis, data-driven and falsifiable: initial compromise generalises universally, but coordination at scale is where reliability and cost bite today. That window is closing as models become more reliable and cheaper. It isn’t “tomorrow is Skynet”. It’s “the entry vector is already universal and persistent, and the coordination friction drops month by month”.

The angle missing from the whole discussion

Every organisation running an agent of this type for productivity today has already installed its own attack infrastructure: an agentic node, with credentials, on the network, with legitimate user access. We’re no longer talking about defending a perimeter against an outside intruder. We’re talking about an actor with execution power, invited inside, that can be hijacked through hostile content it processes anyway.

Simon Willison calls the exploitability condition the “lethal trifecta”: access to private data, exposure to untrusted content, and the ability to exfiltrate. When an agent has all three, it is exploitable by construction. A useful personal agent has all three by design. That is literally its value proposition. It isn’t a misconfiguration you sanitise. It’s the architecture. You can reduce permissions, but an agent that stays useful keeps the trifecta.

For a regulated environment, that shifts the question entirely. Not “did we secure our perimeter?”, but “how many uncontrolled synthetic employees, with SSO access, are running on our network right now, installed by people who just wanted to be more productive?”. Shadow AI is the new shadow IT — except this shadow IT reasons and acts on its own.

Mapping onto DORA and NIS2

Here the scenario stops being a vision and becomes a compliance obligation. The frameworks already exist. No new legislation is needed. They just need to be read correctly.

DORA, Articles 8 and 9, ICT asset inventory and protection. You can’t protect an asset you don’t know you have. An agent installed by an employee on a corporate endpoint, with credentials to internal systems, is an ICT asset in the DORA sense — but one that escapes the classic inventory precisely because it came in through the productivity door, not the IT one. The first control isn’t technical, it’s visibility: identifying and classifying agentic nodes as a distinct asset with their own risk profile.

DORA, Articles 5 and 6, ICT risk governance and management framework. The management body is accountable for ICT risk. An autonomous agent with access to financial systems introduces a risk class absent from most current frameworks: unintended autonomous execution, hijacking via prompt injection, action under an employee’s identity. The management framework must include agentic AI explicitly as a vector, not as a footnote.

DORA, Article 10, detection. Detection must cover specific behavioural indicators: abnormal API call chaining, autonomous tool execution, persistent scanning from AI-associated services, inference-cost spikes. These aren’t in classic EDR signatures. A hijacked agent doesn’t behave like malware. It behaves like a hyperactive user.

DORA, Article 19, incident reporting. An incident caused by a hijacked agent raises a classification problem: is it an external breach or an internal misconfiguration? The reporting deadline runs regardless of the answer. Organisations that haven’t inventoried their agentic nodes will discover too late that an “internal” incident was, in fact, commanded from outside.

DORA, Article 26, threat-led penetration testing (TLPT). This is the strongest hook for a CISO. A TLPT calibrated to the tempo of a human red team tests a threat model that may already be obsolete. When the adversary runs eight agents in parallel across 14 attack chains, with autonomous learning cycles, the legitimate question is: is a test scenario built on the speed and linearity of a human operator still representative? This isn’t a criticism of TLPT. It’s an argument for recalibrating the scenarios.

NIS2, Article 21, risk-management measures. The article is technology-neutral, so directly applicable. Governance, training, incident handling and technical controls built against agentic AI are, simultaneously, evidence of NIS2 compliance. Whoever builds the control builds the audit record too.

NIS2 and the supply chain. The directive emphasises supply-chain risk. An ecosystem of community skills, installable without verification, is a supply-chain vector in the proper sense, not a metaphor. Every trojanised skill installed for convenience is an untrusted dependency inside the perimeter.

Controls, prioritised

Order matters. A CISO who tries everything at once does nothing well.

1. Visibility, non-negotiable. Inventory. You can’t govern what you can’t see. Discover the existing agentic nodes on the network: endpoint telemetry for long-running processes that make network calls and write persistent memory, monitoring of API consumption to model providers, clear shadow-IT policies explicitly extended to AI agents.
2. Breaking the trifecta. If an agent must exist, sever at least one of the three conditions. Segment data access. Isolate the processing of untrusted content. Control exfiltration paths. An agent that can’t touch all three at once is no longer exploitable by injection.
3. Behavioural detection, mapped to DORA Article 10. Not signatures, but patterns of autonomous action.
4. Skill governance. No installation from community registries without verification. Treat an agentic skill like any untrusted code dependency, because that is exactly what it is.
5. Recalibrating the test scenarios under Article 26, to reflect the agentic tempo, not the human one.

What comes next

Taiwan wasn’t an isolated event. It was a public demonstration of a capability class that is already distributed, voluntarily, across tens of thousands of networks — including, probably, yours. The difference between a productivity tool and an attack node isn’t the nature of the software. It’s whether you know you have it, whether you know how it’s isolated, and whether you’ve included it in your ICT risk framework.

For Romania’s financial institutions, under DORA since January 2025 and with NIS2 in transposition, the question is no longer theoretical. It is an inventory, governance and testing obligation that already exists in the text. It just remains to be applied to an asset class most frameworks haven’t yet gotten around to naming.

Want to know how many “synthetic employees” already run on your network, how they’re isolated, and what your trifecta exposure looks like? Get in touch and we start with an inventory of the agentic nodes and a recalibration of the testing scenarios.

Sources

• The Register — “Near-autonomous” AI agents attack Taiwan’s nuclear safety agency
• CyberScoop — First “near-autonomous” AI attack on a government target in Taiwan
• Public report by Dream Research Labs (12 August 2026); confirmation by Taiwan’s Ministry of Digital Affairs; the Anthropic report on the GTG-1002 campaign (November 2025); ENISA Threat Landscape 2025; Simon Willison, “the lethal trifecta”.