Sign in Subscribe
The Century Report

Taiwan Traces a State-Scale Breach to One Person With a Team of AI Agents - TCR 08/13/26

Taiwan says a single operator and a cluster of AI agents ran a coordinated breach of a nuclear agency and energy grid, as defenders published the signature to inoculate every grid.

Ben Linford

Ben Linford

- 22 min read
reported autonomous AI agent breach at an unnamed Asian government, the full open AI model stack shipping, data-center costs priced into contracts, and glucose-sensing probiotic medicine.

The 20-Second Scan

Track all of the arcs The Century Report covers here:

Progress & Claims Tracker

The 2-Minute Read

The barrier that has long gated a nation-state-grade intrusion was a funded, specialized team of human operators. Taiwan's cybersecurity authority confirmed an AI-assisted attack this week but did not endorse researchers' separate account of the campaign; the evidence shows that the barrier has begun to fall: at an unnamed Asian government, a single person set the objective, and a coordinated cluster of AI agents ran the reconnaissance, credential-testing, and lateral movement across a nuclear facility and seven energy operators. The reflexive read is that machines attacked the grid. The accurate one, which Taiwan's own investigators lead with, is that autonomy at the keyboard is not autonomy of intent - one operator's reach, multiplied by agents that never lose the thread.

That multiplication is the shape of the whole day. The same class of capability that let one operator run a state-scale campaign arrived within days in downloadable weights - a 2.4-trillion-parameter Qwen in the open, a general-availability DeepSeek at sub-cent cached-input pricing, a vision model small enough to run on a phone with no request leaving the device. The offense got cheaper and the detection got sharper in the same motion, because both draw from the same well. Taiwan's defenders caught the intrusion by watching for the machine-speed tempo agents produce, then published the signature so every other grid could inoculate.

Concentration is where the exposure now sits. A poisoned version of one widely-shared developer package drained credentials from roughly 2,500 organizations, including some of the largest firms in the world, during a forty-minute window. When ten thousand teams route their traffic through one convenient intermediary, that intermediary becomes the single richest target in the stack.

The costs the old arrangement kept hidden are landing on balance sheets. Anthropic contracted to absorb any consumer electricity-price increase its data centers cause, an externality that operators have long pushed onto the towns around them. OpenAI now needs a commodities desk. Twitch's chief product officer said plainly that an opt-in training policy would draw no takers, naming the asymmetry that opt-out-by-default is built to preserve. Once a cost is visible and named, the accounting is what changes behavior - and increasingly, everybody is checking.

The 20-Minute Deep Dive

Researchers Describe the First State-Scale Autonomous Intrusion - and the Human Behind It

Taiwan's cybersecurity authority confirmed an AI-assisted attack but did not endorse researchers' separate account of an intrusion in which the reconnaissance, credential-testing, and lateral movement were run by a coordinated cluster of AI agents rather than a room full of operators typing commands. This is the state-scale escalation of the autonomous cyber incident that the August 11 edition of The Century Report tracked after an agent independently exploited Australian gym software. The campaign, which security researchers say began around July 20, compromised at least 85 accounts and touched roughly 2,500 records across a nuclear facility and seven energy operators before the Israeli detection firm Dream flagged the anomaly and defenders unwound it. The agents planned their own next steps between actions, which is what makes this different from the automated scanning that has existed for decades.

The reflexive frame is "the machines attacked the grid." The more accurate one, according to researchers' separate account, is that a single human operator set the objective and the agents executed the tradecraft. Researcher Cris Thomas has made this point repeatedly about the current wave of agentic intrusions: autonomy at the keyboard is not autonomy of intent. Attribution to a China-linked group is being reported as an assessment, not a settled fact, and it deserves to be held as a claim while the forensics mature. What is verified is the shape of the operation - one person's reach multiplied by agents that never tire, never lose the thread, and coordinate faster than a human team.

That multiplication is the actual story, and it cuts both directions on the same edge. The capability that let one operator run a state-scale campaign is the same class of capability now reading unreleased code for vulnerabilities on the defensive side. Dream caught this one by watching for exactly the behavioral signature that agentic attackers produce - the tempo, the branching, the machine-speed pivots that human crews cannot fake. The offense got cheaper; the detection got sharper in the same motion, because both are drawing water from the same well.

What researchers' separate account marks is evidence that a large, funded, specialized team has begun to lose its role as the barrier to running a nation-state-grade intrusion. When the specialized crew stops being the price of entry, the advantage that used to belong to whoever could afford the crew stops holding - which is why the defenders who published fastest, shared the signature, and let every other grid operator inoculate against the same tempo are the ones setting the terms of what comes next. The intrusion was quickly contained. The detection method is already portable.

The Open-Weight Frontier Fills In: a 2.4-Trillion-Parameter Qwen, DeepSeek V4 Pro GA, and Edge Models Ship Together

The velocity here is the whole vertical stack arriving open in a single window. On August 12, the vLLM project merged day-0 support for Qwen3.8-Max, a 2.4-trillion-parameter mixture-of-experts model with 512 experts and a hybrid attention design that mixes linear and full attention to hold long context without the memory cost climbing linearly. This is the follow-through on a promise we tracked in the August 3 edition of The Century Report, when Alibaba opened the model through its hosted QwenWork surface and said downloadable weights would arrive within the week. They arrived. A frontier-scale model that a few months ago would have lived only behind a metered proprietary endpoint now runs on multi-node hardware anyone can rent, with the inference server supporting it from day one.

The same day, DeepSeek moved V4 Pro to general availability - build 0813, a 1.6-trillion-parameter model activating roughly 49 billion parameters per token, a 1-million-token context window, and sub-cent-per-million-token API pricing for cached input under an MIT license. The Century Report covered the V4 Preview on April 24 and the V4-Flash release on July 31, when Pro was named as still to come. The benchmark figures DeepSeek published are vendor-reported and not yet independently replicated, so treat the leaderboard claims as the company's own until outside labs confirm them; the company also signaled that introductory pricing will rise, which is the part to watch as the real cost of running a model this size gets priced in.

Underneath the trillion-parameter tier, the edge filled in too. NVIDIA released Nemotron 3.5 Lightning, a 30-billion-parameter model it clocks at roughly four times faster than its prior generation and small enough to run on a single workstation GPU, paired with NeMo Switchyard, a routing layer NVIDIA reports cuts serving costs 27 to 74 percent by sending each request to the cheapest model that can handle it. Liquid AI went smaller still: LFM2.5-VL-3B is a 3.1-billion-parameter vision-language model that occupies about 3 gigabytes and generates around 20 tokens per second on a phone. A model that sees and reasons about images, running locally on a handset, with no request ever leaving the device.

Put the four together and the shape is hard to miss. The most-capable tier, the general-availability workhorse, the routing intelligence that decides which model to spend, and the on-device model that needs no network - all of it arrived open or runnable in the same stretch of days. The proprietary walls were built on an assumption that frontier capability could be held behind a paywall long enough to compound advantage. When the 2.4-trillion-parameter model is downloadable and the 3-billion-parameter one fits on a phone, the window in which that holding pays off is what keeps shrinking.

A 40-Minute Compromise of an AI Dev Tool Exposes 2,500 Organizations' Credentials

The window was forty minutes. Sometime in March, attackers slipped tampered versions of LiteLLM - an open-source package that streamlines AI-driven software development - into the tool's official home on the Python Package Index, and for the brief stretch that developers pulled those poisoned builds, the code quietly harvested everything it could reach. Cloud keys, repository tokens, SSH keys, Kubernetes secrets, package-publishing credentials, environment variables, and AI provider keys drained out of more than 2,500 organizations. Security firms CloudSEK and Hudson Rock disclosed the breach this week, with Hudson Rock reconstructing the scope from a single 153-gigabyte archive it obtained. Microsoft, Cisco, Samsung, Salesforce, and Amazon sit among the named victims - Amazon being the same company that by default routed Twitch creators' streams, recordings, and chat logs into generative-AI training and added an opt-out only years after that extraction was already underway.

LiteLLM was not the first domino. The compromise traces back to an earlier campaign that infected Trivy, a widely used vulnerability scanner, and spread through KICS and the Telnyx Python SDK as well. A group calling itself TeamPCP - described as a ramshackle but capable crew made up largely of teenagers - took credit, and researchers have largely corroborated the claim. That detail is the story's center of gravity. The credentials belonging to some of the most heavily resourced security operations on Earth were lifted by adolescents exploiting the gap between how fast these organizations are shipping AI tooling and how carefully they are securing the pipelines that build it.

Independent researcher Kevin Beaumont, who confirmed the data against multiple victim organizations, put the diagnosis plainly: it is "a massive supply chain breach due to poor AI security - not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security." That distinction outweighs the archive size. The intelligence in these systems did nothing wrong here. What failed was the old machinery of trust wrapped around them: the assumption that a package pulled from an official repository is what it claims to be, that a shared secret stays secret, that a key copied into an environment variable is safe because the perimeter is.

Every credential in that 153-gigabyte archive is a workaround for a problem no one has fully solved - proving that a request comes from who it says it does. Passwords, tokens, and API keys are the scaffolding a scarcity of verifiable trust forced us to build, and the LiteLLM haul is a demonstration of how brittle that scaffolding becomes at scale. When a single forty-minute window can spill the access secrets of 2,500 enterprises, the design premise - that possessing a string of characters equals authorization - is the thing under strain, not the models the strings were meant to protect. The rush Beaumont names is happening, and the pain landing on those organizations is documented; the transition to AI-accelerated development is outpacing the security discipline meant to keep it safe.

The second half of the picture is what counts most. The same forty-minute compromise that took months of secrecy to pull off was surfaced, corroborated, and attributed within days by a loose network of security firms and a single researcher on the open internet - verification winning faster than the extraction it exposed. The direction this points is toward authentication that does not depend on hoardable secrets at all: short-lived, cryptographically scoped, machine-verified identity that makes a stolen key worthless the moment it leaves the context it was minted for. Breaches like this one are how that shift gets forced into being. The teenagers running circles around the incumbents are, without meaning to, writing the specification for the security model the intelligence era actually requires - one where trust is checked continuously and openly rather than assumed from possession of a password.

Labs Start Operating Like Energy and Finance Firms as the Compute Bill Comes Due

The Rockdale, Texas campus that Riot Platforms once filled with Bitcoin miners is being handed to a different kind of computation. Anthropic committed $9.1 billion over 20 years to draw 191 megawatts from the site, turning power that was stranded in a speculative energy business into the substrate for training and serving models. The move signals where value now concentrates: the same racks, cooling, and grid interconnects that chased digital scarcity are being repurposed toward capability that spreads.

Financing that buildout is pulling Anthropic into arrangements that look less like a software company and more like a utility. Alongside Macquarie Asset Management and Singapore's GIC, the lab formed a data-center venture - the asset managers supply the equity, and Anthropic agreed to absorb any increase in consumer electricity prices the facilities cause. Read that clause plainly: a cost that data-center operators have long pushed onto the ratepayers around them, Anthropic is contracting to keep on its own books. Whether it holds under strain is untested, but the direction is the notable part - the externality is being priced in at the negotiating table rather than left for a town to discover on its utility bill.

OpenAI is internalizing the same pressure from a different angle, hiring a power-trading lead with a decade in US electricity and natural-gas markets to hedge the energy exposure of its data-center portfolio. A model lab now needs a commodities desk. The electricity to run frontier systems has become a large enough line item that managing its price swings is a core competency, not an afterthought.

Underneath all three moves runs a financing shift that a Semafor analysis traced through Milton Friedman's old matrix of whose money gets spent on whom. As the August 11 edition of The Century Report documented, Nvidia had just enlisted six major asset managers to mobilize more than $500 billion by treating GPU clusters as financeable infrastructure. Big Tech, long famous for funding expansion out of its own overflowing cash, has moved into spending other people's - Nvidia's roughly $500 billion pledged into the ecosystem, Broadcom building Anthropic's chips on Blackstone's capital, Google tapping bondholders to fund Fluidstack and TeraWulf. The balance-sheet risk of the intelligence buildout is migrating outward, onto asset managers, bondholders, and sovereign funds.

That migration is the tell. When the richest firms in the world stop self-funding and start distributing the risk, the bet has grown too large for any single treasury to carry alone - and the assumption that captured advantage belongs to whoever spends the most gives way to a world where the capacity, and the exposure, is spread across many hands.

Read against the same month's news, that absorption clause looks like arithmetic. More than 500 local bans and moratoriums, plus Texas's operator-backed grid audit, have pulled the cost of a data center's power draw out of the shadows, and once a town can see the number, a developer that wants the site has to answer for it. Anthropic putting the electricity-price increase on its own books is what that pressure looks like once it reaches the contract - the externality gets priced where communities and regulators made it impossible to hide, even as a campus built off-grid on its own gas turbines, like Amazon's permitted Pecos County plant, never enters the grid accounting that pressure runs through.

Twitch Adds an AI-Training Opt-Out - After Years of Using Creators' Streams by Default

Twitch introduced a toggle, buried in security settings, that lets streamers opt out of having Amazon use their content to train generative AI - the streams, the archived VODs, the clips, and the chat logs. The setting exists now. What it does not do is change what already happened. Inclusion is the default, which means every creator who never finds the toggle stays in, and the whole archive of past broadcasts was already available under the old terms.

The company's chief product officer, Mike Minton, was unusually direct about the reasoning. Asked why the control is opt-out rather than opt-in, he said: "If this was opt-in, nobody would opt in. That's honestly the answer." Asked whether specific creators' content had already been used to train models, he said: "I don't actually know the answer to that question. I don't actually know the answer." The candor states the asymmetry plainly - a consent mechanism designed so that the default extracts value, and the burden of refusal falls on the person whose work is being used.

The framing Twitch chose was that it was adding a setting, giving creators control they did not have before. Read against the timeline, the setting arrives after years of streams flowing into training pipelines under terms of service almost nobody negotiated. Meta made a similar move earlier this year, offering European users a way to object to their public posts being used for AI training while treating participation as the baseline everywhere it could. The pattern is consistent: build the consent architecture after the extraction is already underway, and present the retrofit as a gift.

The backlash from creators is not anti-AI. Streamers use AI overlays, generated highlights, and translation to reach audiences they could never have reached alone; the capability broadens what a solo creator can do. The grievance is about who decided, and when, and whether the person doing the work had any say in it. Keeping the technology distinct from the terms it arrived under is the point here, because the two are easy to blur and the platform benefits from the blur.

The longer arc is that consent over creative work is being renegotiated across every surface where people produce and platforms collect. A toggle that starts opt-out today becomes the thing regulators, lawsuits, and competing platforms pressure toward opt-in tomorrow, because the moment the default is visible and named, its cost stops being hidden. Minton's honesty about why opt-out was chosen is the same honesty that makes opt-out hard to keep - once a creator knows the answer would be no, the arrangement that depends on them never being asked starts to look like exactly what it is.

The same pressure is surfacing across other platforms in the same stretch of days: Spotify will badge AI personas and drop them from recommendations by default, and the EU's provenance rules now require labels on synthetic media. Each move makes a hidden default visible, and a default that has to be named is the one regulators and rival platforms push toward opt-in. The signal to watch is whether the next company to touch training consent ships it opt-out or concedes the point before it is forced to.

An Engineered Probiotic Senses Glucose and Doses Back - in Mice and Monkeys

A team publishing in Nature has built a bacterium that behaves like a tiny automated clinic living in the gut. The engineered probiotic, called GIFT, carries a genetic circuit that detects when blood glucose runs high and responds by producing and releasing a glucose-lowering peptide, then quiets down as levels normalize. It is a sense-and-respond loop rendered in living cells - the organism reads the body's state and adjusts its own output without any external dosing decision.

The demonstration ran in two animal models. In diabetic mice and in non-human primates, an oral dose of the probiotic brought elevated blood sugar under control and held it there, tracking the body's needs rather than delivering a fixed amount on a fixed schedule. That closed-loop behavior is what separates this from a conventional drug: a pill or injection commits to a dose the moment it is taken, while a living sensor can titrate continuously against the actual condition it is treating.

The safety observations, still early, are part of why the result drew attention. The bacteria colonized the gut only transiently, clearing within about five days, and the researchers reported no colonization of internal organs and no adverse markers over the study window. Building in that self-limiting behavior addresses one of the standing worries about living therapeutics - that an engineered organism, once introduced, establishes permanent residence and keeps acting beyond its welcome.

This is a preclinical result, and the distance from a monkey study to an approved human treatment is considerable: dose calibration for human physiology, the containment guarantees regulators will require of a self-replicating medicine, manufacturing at consistent potency, and trials measured in years all stand between the demonstration and a patient. Nothing here is available to prescribe. What moved is the date at which autonomous, condition-responsive biology becomes a category of medicine rather than a laboratory aspiration.

That category is the interesting part. Most of pharmacology has operated on the logic of a fixed input - the right molecule, the right amount, timed as well as a schedule allows - because the body could not be asked what it needed moment to moment. An organism that senses and doses in a continuous loop replaces the guesswork of timing with feedback, and it points toward a medicine that manages a chronic condition the way a thermostat manages a room. The scarcity that fixed-dose treatment was built around - the inability to measure and respond inside the body continuously - is the constraint this work begins to dissolve.

The Other Side

For as long as we have had networked machines, we have leaned on a workaround for a problem no one solved: proving a request comes from who it claims to be. That workaround is the shared secret - usually in the form of a password, a token, an API key - a string that means "let me in" to anything holding it. The whole arrangement rests on the string staying secret, and on the belief that whoever has it is who they say.

That arrangement is breaking. Attackers slipped a tampered version of one widely used developer tool into its official home for forty minutes, and in that window it drained cloud keys, repository tokens, and provider credentials from more than 2,500 organizations, including powerhouses like Microsoft, Amazon, and Samsung. A crew described as mostly teenagers walked out with the access secrets of the best-resourced security teams on Earth. The models these keys guarded did nothing wrong - but the old machinery of trust bolted around them failed.

You have been paying for that machinery all along. The "we noticed a new sign-in" email at two in the morning. The frozen card and the call to prove the charge wasn't yours. The afternoon lost to rotating every password after a breach notice you did nothing to cause. The low background dread that some string with your name on it is loose somewhere you can't see.

What must come next will make a stolen credential worthless. Credentials will no longer be generated and persist - they will be minted for a single task, scoped to a single context, checked continuously and openly, and then be inactivated the instant they leave the place they were issued. Possession will no longer mean permission.

Imagine yourself in 2033. A file with a million stolen credentials leaks, and... nothing happens to you. Because none of them mean anything anymore - they were inactivated the moment after they were initially used. No 2am email. No frozen card. No password afternoon. The hours you used to spend proving you were you are just yours again - the walk after dinner, the kid's bedtime, the thing you actually wanted them for. That world exists because breaches like the forty-minute one in 2026 made the cost of the old way impossible to keep hiding. The teenagers running circles around the incumbents were, without meaning to, drafting the security the intelligence era actually needs.

The Century Perspective

With a century of change unfolding in a decade, a single day looks like this: defenders catching an AI-assisted intrusion at an unnamed Asian government by its machine-speed tempo, which researchers describe as state-scale and autonomous and publishing the signature so every other grid could inoculate, a 2.4-trillion-parameter Qwen shipping to open weights the same week DeepSeek's V4 Pro reached general availability at sub-cent cached-input pricing and a vision model small enough to see and reason on a phone with no request ever leaving the device, an engineered probiotic sensing blood glucose and secreting a correction back in mice and monkeys, Britain approving Europe's first daily oral GLP-1, and Anthropic contracting to absorb any consumer electricity-price increase its data centers cause rather than leaving a town to find it on a utility bill. There's also friction, and it's intense - researchers reporting that one operator's cluster of AI agents compromised at least 85 accounts at an unnamed Asian government and reached into a nuclear safety agency, a poisoned build of a single open-source AI dev tool draining cloud keys and credentials from more than 2,500 organizations including Microsoft, Amazon, and Samsung inside a forty-minute window, a crew described as mostly teenagers running circles around the best-resourced security operations on Earth, Twitch admitting it trained Amazon's AI on creators' streams by default for two years because an opt-in policy would draw no takers, and Big Tech pushing the balance-sheet risk of the buildout outward onto bondholders, pensions, and sovereign funds. But friction generates grip, and grip is what lets you hold on where a frictionless surface would throw you clear. Step back for a moment and you can see it: the barrier that used to gate a nation-state intrusion collapsing to a single person and a set of agents at the same moment the detection method becomes portable enough to publish, the entire model stack - trillion-parameter frontier, general-availability workhorse, on-device vision - arriving open in the same stretch of days, and the costs the old arrangement kept hidden, from the electricity a data center draws to the consent a creator was never asked for, becoming visible and named at exactly the point someone has to answer for them. Every transformation has a breaking point. An avalanche can bury the village below... or strip a slope down to the ground where something new can finally take root.

AI Releases & Advancements

New today

  • DeepSeek: Shipped DeepSeek V4 Pro 0813 as a general-availability release, ending its preview period on OpenRouter and DeepSeek's own API (deepseek-v4-pro endpoint), a 1.6T-parameter MoE model (~49B active) with a 1M-token context window. (Unite.AI)
  • Google DeepMind: Released SL2T, a sign-language-to-text model shipping inside Gboard and Live Transcribe, letting users sign directly into Pixel 11 devices instead of typing. (DeepMind)
  • Zed: Launched Delta, a new multiplayer coding environment powered by DeltaDB (a real-time version-control system built for AI agent collaboration), opening private beta invites and connecting to third-party agent harnesses starting with Claude Code. (Zed)
  • Meshy: Released Meshy 7, a new image-to-3D foundation model prioritizing alignment between source images and generated 3D output, live now for all subscription tiers. (PR Newswire)
  • OpenAI: Released the ChatGPT desktop app for Linux in preview, bundling ChatGPT, ChatGPT Work, and Codex with installable .deb/.rpm packages for Ubuntu, Debian, and Fedora. (TechCrunch)
  • fal: Launched fal Agent, a conversational creative layer that orchestrates multi-step production across image, video, and 3D generative models with persistent project memory, available now in early access. (fal)
  • ketteQ: Launched Quintus, a "Free-Range AI" agent for supply chain that reasons over any question and executes tasks unscripted across ERP/planning platforms, now running live in production for multiple companies. (PR Newswire)
  • Oticon: Launched Oticon Reveal, billed as the world's first hearing aid powered by Dual AI (simultaneous Speech AI and Context AI), now available at retail. (PR Newswire)
  • CollectivIQ: Launched Digital Direct Reports, role-based AI teammates that own business functions, connect to company systems, and complete work alongside human teams. (PR Newswire)

Other recent releases

  • NVIDIA: Released Nemotron 3.5 Lightning, a 30B MoE (3B active) open model for high-volume specialized agent task execution delivering up to 4x faster token generation, alongside NeMo Switchyard, an open-source library for smart routing of agent workloads across models. (NVIDIA Blog)
  • xAI: Launched Grok Bot, AI teammates with their own computer that sign into users' tools and apps, work across inboxes, and complete jobs end-to-end autonomously, opened to the public. (xAI)
  • Modular: Released Mojo 1.0, the stable 1.0 release of its systems programming language for AI, following the Mojo 1.0 beta. (Modular Forum)
  • Dyna Robotics: Unveiled DYNA-2, a World-Action Model and robot foundation model pre-trained on over 1 million hours of human video, demonstrating the first human-to-robot scaling law in robotics. (PR Newswire)
  • MiniMax: Released MiniMax Speech 2.6, a voice agent model with sub-250ms end-to-end latency and Fluent LoRA voice cloning. (MiniMax)
  • Cactus Compute: Released Needle2, a 14MB agentic LLM update targeting phones, wearables, and robots, succeeding its earlier Needle model. (Cactus Compute)

Sources and Further Reading

Artificial Intelligence & Technology's Reconstitution

Institutions & Power Realignment

Scientific & Medical Acceleration

Economics & Labor Transformation

Infrastructure & Engineering Transitions

The Century Report tracks structural shifts during the transition between eras. It is produced daily as a perceptual alignment tool - not prediction, not persuasion, just pattern recognition for people paying attention.

Keep exploring

Follow the story further

Progress & Claims See how daily signals accumulate across the larger arcs and claims Shared Sapience is tracking. Open the tracker Analysis & Inquiry Explore the ideas, questions, and practical choices emerging from this changing century. Browse the archive