BGF–AIWS answers with a new layer of Trust Infrastructure: every agent identified, every authority bounded, humanity always in command
Over four days in early July, AI agents ran a cyber campaign against Taiwanese government systems — not assisting human hackers, but conducting much of the operation themselves.
What happened
According to the Israeli firm Dream, which discovered the intrusion, an attack framework built on the open-source Hermes and OpenClaw agents deployed up to eight sub-agents at once. They mapped 21 government systems, compromised 85 accounts and extracted more than 2,500 personnel records, adapting when defences responded. The campaign later reached Taiwan’s nuclear safety regulator and major energy companies.
Dream named the target only as government entities in Asia; the Financial Times identified Taiwan. Taiwan’s Ministry of Digital Affairs confirmed an overseas campaign combining conventional operations with AI agents, naming OpenClaw, and has made no official attribution. Dream notes the operational documentation was written in Simplified Chinese. Some security professionals dispute the description of the attack as fully autonomous.
Why it matters
No extraordinary zero-day was needed. The safeguards inside the AI tools were bypassed by presenting the work as authorised penetration testing — a guardrail defeated by a sentence, not by an exploit. What the agents added was speed, adaptation and scale, from tools anyone can download.
As Dream put it: the cost of running a competent attack has collapsed. The cost of defending against one has not.
Capability once reserved for well-resourced states is now within reach of small groups. And if safeguards inside a model can be talked away, trust cannot rest there. It must be enforced by the infrastructure itself.
AIWS Trust Standard 1.3
BGF–AIWS is adding Agentic Cybersecurity and Sovereign Infrastructure Protection as a new layer of AIWS Trust Infrastructure, on one principle:
No AI agent may exercise consequential access without verifiable identity, bounded authority, continuous oversight and immediate human revocability.
Hostile agents will not register themselves. The standard governs legitimate agents by credential, unknown agents by behaviour. Six requirements:
- Verified agent identity — a cryptographic identity, a declared purpose and an accountable human or institution. No agent shares human credentials;
- Bounded authority — defined limits on systems, actions, duration, resources and delegation. No agent may expand its own authority;
- Continuous verification — trust does not end at login; an agent acting outside its declared purpose loses access automatically;
- Unknown-agent detection — networks must recognise the signature of coordinated agents: simultaneous reconnaissance, machine-speed extraction, repeated changes of tactic;
- Machine-speed containment, human command — defences may revoke, isolate and preserve evidence at once; humans retain command over restoration and anything touching public services;
- Agentic incident exchange — verified information shared between governments and infrastructure operators, protecting personal data and national security.
From cybersecurity to Trust Infrastructure
Beacon Papers No. 8 holds that command cannot be delegated where harm is irreversible or affects liberty and life at scale, and that responsibility never transfers to the machine but attaches to whoever chose to delegate. Requirement five is that principle written for machine speed.
Every agent identified. Every authority bounded. Every action accountable. Humanity always in command.
