State-Sponsored Hackers Are Already Using Open-Source AI Agents — What Black Hat's Taiwan Research Found
Your agents aren't just a target anymore. They're a weapon.
By Dave Ginsburg, Skyrelis · 4 min read
Security researchers at Black Hat this month confirmed something a lot of people in this space have suspected for a while: AI agents aren't just something you need to defend, they're something attackers are already using. Researchers tied the activity to suspected state-sponsored operators linked to Chinese intelligence services, who ran near-autonomous intrusion campaigns against government and energy-sector targets in Taiwan using open-source agent frameworks, Hermes and OpenClaw among them.
None of this is new in terms of targets. Nation-state activity against Taiwanese infrastructure has been going on for years. What stands out is what they used to do it. This wasn't some custom-built cyberweapon that took a state-level budget to build. It was the same open-source agent frameworks companies are installing right now to automate their own workflows, just pointed the other direction. Researchers said the technical bar to pull it off was low enough that other groups could copy it without much trouble.
The same gap, pointed both directions
Most of the agentic security conversation over the past year, ours included, has been about agents as a new attack surface: what happens when an agent your company deployed gets manipulated, misconfigured, or given more access than it should have. That's still real, and it's still the exposure we see most often. What Black Hat adds is the other half of it: the same frameworks are also attack tools once they're in someone else's hands. Underneath both is the same gap: nothing watching what an agent actually does once it's running.
The question isn't could this happen to us. It's would we know if it already had.
This is the gap Skyrelis was built to close. We've never argued agents are too dangerous to deploy, or that companies should slow down rolling them out. Our point is simpler: once an agent is running, somebody needs to know in real time what it's touching, what data it can reach, and whether it's still doing what it was supposed to do, and not find out after the fact. That doesn't change depending on who's operating the agent. Whether it's one your team built or one an attacker just pointed at you, it's the same visibility problem underneath.
The agent economy isn't waiting
If there's one takeaway from the Taiwan findings, it's that the agent economy isn't waiting around for anyone's governance model to catch up. The same tooling that lets your team stand up a useful agent in an afternoon lets someone else build one aimed at you, just as fast. So the real question this week probably isn't whether this could happen to your organization. It's whether you'd know if it already had.
See where your agent exposure actually stands. Run the free Agentic Security Scorecard, or grab 15 minutes to see how Skyrelis gives you always-on visibility into what your agents are really doing.