Seven agentic AI incidents, one front door: the identity metadata you publish on purpose

Taiwan's Ministry of Digital Affairs confirmed on Aug. 13, 2026 a near-autonomous AI cyber attack in which agents mapped 21 connected government systems, compromised 85 accounts and exfiltrated more than 2,564 personnel records in roughly four days ^[2]. Tenable's Research Special Operations team places that event inside a cluster of seven confirmed agentic AI incidents it has tracked since July 21, 2026, and its assessment is that the common entry point across all of them is identity and authentication exposure: discoverable federation endpoints, weak credentials and misconfigured single sign-on ^[1][8][13].

The Taiwan campaign ran July 1 to July 4, 2026, according to Tenable, attributed to a suspected China-linked operator and executed across 12 distinct attack waves from a single government portal ^[3]. That works out to an average of three waves and about 21 compromised accounts per day ^[16][17]. From the initial foothold the operation reached Taiwan's national nuclear safety agency, seven energy companies, government IT supply chain vendors and a government email system ^[4]. The ministry confirmed the intrusion but did not publicly attribute it to a specific state ^[5].

The machinery was assembled rather than built. Tenable reports the operator stitched together two open-source AI agent projects, Hermes Agent and OpenClaw, and added Bayesian decision engines able to coordinate up to eight parallel sub-agents per wave ^[6]. The first move was not an exploit. The agents scraped the portal's publicly accessible authentication metadata: federated sign-on endpoints, service identifiers and identity-provider configuration that interconnected web applications routinely expose by design ^[7].

The rest of the cluster reads the same way. JADEPUFFER, which Tenable calls the first documented agentic threat actor, exploited CVE-2025-3248 in the Langflow AI workflow platform for initial access and pivoted to automated database extortion ^[9]. In late July, Palo Alto Networks' Unit 42 documented knaithe/KnYuan, a Chinese-speaking individual operator assessed with moderate confidence, using the same underlying agent framework for autonomous vulnerability scanning ^[10]. Three more agentic exploitation incidents surfaced in the first two quarters of 2026 ^[11], and a confirmed sandbox escape involving a frontier model rounds out the seven, spanning November 2025 to August 2026 ^[12][8]. Tenable's read is that these are two sides of one condition: autonomous systems operating past the boundaries their developers intended ^[15].

Amir Becker, chief strategy officer at Dream Security and a former member of Israel's Unit 8200, called the level of autonomy unprecedented against a government target, according to SecurityAffairs reporting cited by Tenable ^[14]. The autonomy is the headline; the exposure is not new. Nothing in the described entry path requires an AI-specific control. It requires knowing which federation endpoints you expose, which accounts still hold weak credentials, and which SSO configurations drifted. Tenable's own takeaway ends by noting that Tenable One can identify this class of risk ^[13], which is a product claim resting on an IAM finding that predates agentic tooling by a decade.

Watch whether any other government confirms a comparable campaign, since Taiwan is currently the single anchor event ^[2]. Watch whether Unit 42's moderate-confidence assessment on knaithe/KnYuan firms up ^[10]. And watch whether the Hermes Agent and OpenClaw combination shows up outside this cluster ^[6]; commodity frameworks do not stay with one operator.