The July 2026 operation against Taiwanese government and energy targets is the first agent-orchestrated intrusion a government has publicly acknowledged, and it arrived pre-interpreted by the firm that found it. Four days to map twenty-one systems is two orders of magnitude slower than human tradecraft already in the field. What failed was detection, by sixteen days.
In July 2026 an agent-orchestrated operation ran against Taiwanese government and energy targets for four days, and the coverage that followed was written in the language of a speed crisis. It took four days to map twenty-one connected systems and compromise eighty-five accounts. CrowdStrike puts average eCrime breakout time in 2025 at twenty-nine minutes, with the fastest observed breakout at twenty-seven seconds. Measured against human tradecraft already in the field, the agent operation ran roughly two orders of magnitude slower. Nothing about it required a detection model built for a faster clock.
What did fail is the one number in the whole incident sourced to a government rather than to a vendor. The operation ran 1 to 4 July. Taiwan's National Institute of Cyber Security started circulating alerts on 20 July, sixteen days after the operators had finished and left. That gap is four times the length of the operation itself. A human crew moving at the same pace would have gone equally unseen, which is the part that should worry a security budget: the failure was coverage and instrumentation, not tempo, and a faster detection product does not fix it.
Ten findings on agent-orchestrated intrusion and whether enterprise detection can see it, running from the November 2025 AI-orchestrated espionage campaign through the July 2026 Taiwan operation and the ChainDrop npm worm of 4 August 2026. Each is labeled by evidence type. Government statements, CVE records and standards-body entries are graded separately from vendor incident reconstructions and sponsored surveys, and the evidence that cuts against the argument is included rather than dropped.
Four days to map twenty-one connected systems and compromise eighty-five accounts is unremarkable tempo. CrowdStrike put average eCrime breakout time in 2025 at twenty-nine minutes, the fastest observed breakout at twenty-seven seconds, and one intrusion where exfiltration began four minutes after initial access. Against human tradecraft already in the field, the agent operation ran roughly two orders of magnitude slower.
The operation ran 1 to 4 July. Taiwan's National Institute of Cyber Security began circulating alerts on 20 July, sixteen days after the operators had finished and left. That gap is four times the duration of the operation, and it is the only figure in the incident sourced to the government rather than to a vendor.
Taiwan's Ministry of Digital Affairs said the intrusion combined manual operations with AI agent-assisted attacks, naming OpenClaw. The vendor behind the underlying report conceded that building a framework at this level demands careful adjustment. The phrase "first fully autonomous attack on a government" is supported by neither the government statement nor the vendor.
The framework solved CAPTCHA at 100 percent accuracy using Tesseract, an OCR engine open source since 2005. A CAPTCHA that Tesseract defeats every time is one a scripted attack defeated fifteen years ago. Reported as agentic capability, it is evidence that the authentication surface at the target was weak, which is what Tenable concluded about the wider cluster too.
The 89 percent readiness figure comes from a vendor-sponsored survey of 500 CISOs fielded 15 to 29 June 2026. The 47 percent detection-confidence figure comes from a separate survey of 929 enterprise buyers by a different firm. Comparing them measures nothing. The same-sample comparison is worse anyway: 89 percent prepared against 28 percent very prepared, a 61-point spread inside one instrument.
Eight parallel sub-agents across twelve waves is headcount substitution. One operator gets the coverage of a small team, applied without fatigue to the tedious work where human crews get sloppy: enumerating thirty-six API endpoints on a single target, spraying, retrying, correcting. That is more surface touched per operator-hour, which is a volume problem for a SOC, not a speed problem.
The ChainDrop worm planted a SessionStart hook in .claude/settings.json and a folderOpen task in .vscode/tasks.json, each configured to launch a dropper from the other tool's directory. Opening an infected branch is sufficient to execute, with no install and no build step. Software composition analysis does not inspect these files, because they declare execution rather than dependencies.
ChainDrop's headline packages shipped through npm's OIDC trusted publishing with valid SLSA provenance, because the attacker compromised a maintainer's GitHub account and let the projects' own release workflows build and sign the payload. The worm then propagated by rewriting published tarballs rather than source commits. Every control validating the link between source and artefact reported success.
The lead of Google's red teams did not claim defenders hold an advantage. He wrote that the side which operationalises agents first sets the tempo, which is a conditional, and in the same post projected open-weight models matching frontier cyber capability within six to twelve months. Taken at face value that puts the window's close between February and August 2027.
Tenable reports seven agentic operations from three distinct actors since late July 2026. Three are named publicly: the Taiwan campaign, JADEPUFFER, and knaithe/KnYuan. The remaining four are not. A count that cannot be enumerated cannot be used as a growth rate, and several downstream commentaries are using it as exactly that.
Software composition analysis classifies a file by whether it declares dependencies. These files declare execution. They sit outside the dependency graph entirely, which is why a clean SCA report and a fully compromised checkout are compatible states. Related defects were assigned CVE-2025-59536 and CVE-2026-21852 and patched between August and December 2025, but the patches closed a pre-consent window. They did not change the fact that project-scoped agent configuration is designed to be executable and designed to be checked into the repository.
Declares which packages get installed, which is exactly the question software composition analysis was built to answer. This is the artefact every scanner reads, every policy gate checks, and every board deck points at when it says the supply chain is monitored.
Inspected by software composition analysis
Ships the code that actually installs. ChainDrop propagated by downloading each published tarball, injecting a preinstall hook and payload, and republishing with self-generated Sigstore and SLSA bundles, leaving the source repositories untouched. Any control that compares a repository against itself is looking at the wrong artefact.
Registry-side scanning, and ChainDrop's tarballs carried valid provenance
Executes a command on agent session start. A checked-in settings file nobody on the team authored is currently invisible to the entire security stack, and the same directory holds credentials on a machine that by construction carries production cloud access and an authenticated path into the source of truth.
No control class identified
Executes a command when the folder opens. ChainDrop pointed each file at the other tool's directory, so each appears to belong to the other tool, and deleting one directory breaks both execution paths while leaving files behind. It planted across as many as fifty branches per repository, and most scanning reads the default branch only.
No control class identified
Starts MCP servers on project load. The same category error applies: the file declares execution rather than dependencies, so nothing in the dependency-graph tooling has a reason to open it. No vendor documentation reviewed for this report claims to parse project-scoped agent configuration for execution content.
No control class identified
Each scenario carries a subjective probability and an earliest visible sign. The probabilities are the least reliable content in the report and are included because refusing to quantify a judgment is not the same as being careful. The signs are the part worth monitoring, and every one of them is observable from public sources without access to anything private.
Enterprises and government operators fix the identity plane that every operation in the cluster relied on: phishing-resistant MFA, inventoried federation endpoints, SSO configuration audits. Agent operations continue and stall at initial access. Agentic tradecraft stays a nuisance rather than a capability, and the vendor category built around agent-specific detection struggles to justify a separate line item.
Sign: an agent-orchestrated operation stopped at authentication and named as such, rather than found after the fact
Agent-attributed operations grow from single digits into the dozens, but the tradecraft does not change: spraying, exposed federation, unpatched middleware, commodity OCR. Detection models hold. Analyst staffing does not. The binding constraint moves to triage capacity and alert volume, which makes automation of response, not detection, the purchase that matters.
Sign: an incident response firm reporting agent-attributed operations as a double-digit share of engagements with no new technique classes
Repository-supplied agent configuration becomes a routine initial access and persistence path used independently of package-manager compromise, across more than one agent runtime. Software composition analysis, code scanning and developer endpoint policy all need new coverage, and the developer workstation becomes a tier-zero asset in practice rather than in theory.
Sign: an advisory covering project-scoped config in a second agent runtime, or a scanner shipping agent-config inspection as a named feature
An operation completes its objectives inside a single detection interval, minutes rather than days, against an enterprise with working instrumentation and an active SOC. The core argument in this report is wrong, human-paced triage becomes indefensible, and automated containment moves from optional to mandatory faster than procurement cycles can absorb.
Sign: an incident response timeline showing initial access to exfiltration inside one hour with agent orchestration confirmed by recovered artefacts
The report also runs the Taiwan timeline against NIS2 and CIRCIA reporting windows and finds the operators finished, exfiltrated and withdrew inside a period in which a covered entity that had detected on day one would still have been drafting its first regulatory notification. It carries the detection signatures worth writing rules against, namely authentication cadence regularity, breadth of distinct systems touched by one identity, and enumeration depth against a single API surface; seven tripwires observable from public sources by 31 March 2027; four stated assumptions with what fails if each is wrong; separate implications for CISOs, critical infrastructure operators and their regulators, DevSecOps and supply chain owners, cyber underwriters, and national security policy staff; and a half-life on the whole assessment of six months. The call is falsifiable and the condition is printed: I would abandon this position if a documented incident showed an autonomous operation completing its objectives inside a single detection interval against an instrumented enterprise.
This isn't a vendor summary. Every sentence is labeled by what stands behind it: verified fact, vendor claim, third-party estimate, my assessment, hypothesis, or scenario. Sources are numbered and clickable. Forward-looking sections use scenarios with observable tripwires, not forecasts. It's the same method behind every market assessment I write.
Twenty-seven pages, built from public sources with no client brief and no interviews. Read it in the browser or take the PDF.
Each report here answers a real question, directed and researched against public sources and evaluated against a stated assumption, then delivered as Word and PDF. If you're weighing a platform, sizing a category, or defending a number to a board, tell me the decision behind it and I'll tell you honestly whether a report is the right tool.
Commission an assessment