When Several AI Agents Act at Once, Who Is Actually in Control?

We have spent a lot of time asking what one autonomous agent should be allowed to do.

The incident that Dream, an Israeli AI and cyberdefense firm, shared with the Financial Times this week introduces a harder version of that question. What happens when several of them are acting at once?

That is not a small change.

What the reporting establishes

On August 12, 2026, the Financial Times reported findings from Dream describing an operation against Taiwanese government systems that ran over four days in early July 2026. Multiple cybersecurity outlets confirmed and built on the reporting the same day.

According to reporting based on Dream's findings, the attackers assembled an autonomous platform from two publicly available AI agent frameworks, Hermes and OpenClaw. At its peak, the platform deployed as many as eight agents simultaneously.

Over those four days, the platform:

• surveyed 21 Taiwanese government systems
• researched vulnerabilities and mapped weak points
• adapted its approach whenever defenders blocked a route
• compromised at least 85 government accounts
• extracted more than 2,500 personnel records
• expanded its activity to Taiwan's nuclear safety agency
• reached at least seven energy companies

Dream said it discovered the evidence from a 160-megabyte archive of 1,395 files that the operators had left exposed online during broader threat-tracking work. The tool's most striking behaviour, according to Dream, was its capacity to continuously rank and reprioritise attack paths against the evidence it was gathering. When one route failed, the platform dispatched another agent to search for fresh intelligence and devise a different approach.

Amir Becker, Dream's chief strategy officer and a former head of cyber operations at Israel's Unit 8200 signals-intelligence agency, described the operation as an unprecedented "end-to-end autonomous attack" on a government target. CyberScoop, reporting on the same findings, used the characterisation "near-autonomous." The gap between those two descriptions is the unresolved factual question at the centre of this incident, and I will come back to it.

Attribution

Dream identified the use of Simplified Chinese in internal communications associated with the operation and described this as indicating a "high probability" that the operator was connected to China. Dream did not name a specific threat actor or group.

When this analysis was first published on August 12, Taiwan had not publicly confirmed the incident. That changed the following day. Taiwan's Ministry of Digital Affairs told Reuters that government agencies had detected an abnormal cyberattack in July, involving a combination of manual operations and AI agent-assisted attacks. The ministry described the attacks as displaying clear characteristics of an overseas source and noted that affected agencies had handled the incident. The ministry did not attribute the operation to China or name any specific threat actor.

Three distinct layers of evidence now bear on this incident: Taiwan's Ministry of Digital Affairs confirms the underlying AI agent-assisted attack against government agencies. Dream provides the detailed technical reconstruction, including the multi-agent architecture and the operational evidence found in the exposed archive. Independent journalism provides broader context. Taiwan's confirmation is not confirmation of every operational detail in Dream's reconstruction. The specific numbers, the precise systems affected and the complete picture of the operation remain attributed to Dream.

No Chinese government statement acknowledging or denying involvement appeared in any reporting reviewed for this article.

I will use "suspected China-linked" throughout, because that is what the evidence supports. Saying "China attacked Taiwan" would be false precision.

What we do not know

Dream's findings were shared with the Financial Times rather than published in an accessible public report. The domain dream.security does not currently resolve. I cannot read Dream's full analysis, and everything available through independent reporting reflects what Dream disclosed to the FT and what other outlets subsequently confirmed from that disclosure.

More importantly, we do not know how the agents coordinated. The reporting tells us agents operated simultaneously and that when one route failed, another was dispatched to research alternatives. It does not describe the coordination architecture. We do not know whether agents shared state, communicated between tasks, or simply ran in parallel against a common target set. We do not know whether a human operator was directing agents between sessions or whether the platform made those decisions itself.

I am not going to describe a coordination architecture I cannot source. The reporting establishes what the agents did. It does not establish how they decided to do it.

Taiwan's Ministry of Digital Affairs confirmed the underlying attack and noted that its national institute of cyber security issued warnings beginning July 20. That date is now publicly established. What Taiwan's confirmation does not resolve is the detailed technical reconstruction provided by Dream. The specific number of agents, the precise accounts compromised, the full list of systems targeted and the complete operational architecture remain attributed to Dream's analysis, not to any government statement. We do not know which specific threat actor was responsible. Taiwan described characteristics of an overseas source but made no attribution to China or any named group.

Why several agents change the question

Most agent security writing deals with a single agent acting against a system. One objective, one executor, one trail. The control question has a bounded shape: what was it allowed to do, and what did it actually do?

When several agents act simultaneously toward the same objective, that shape changes in ways I think are important.

The first change is distributed execution. If as many as eight agents were operating at once, then up to eight streams of individual decisions were running in parallel. Each agent may have been making its own choices about which path to try. Knowing the platform's overall objective does not tell you which agent had authority to make which individual decision, against which specific target, at which moment.

The second change is a shared environment. One agent's reconnaissance changes what the next agent's query returns. One agent's login attempt may trigger a defensive response that another agent then has to route around. Agents acting concurrently are not acting in independent contexts. They are acting in a shared one that each of them is continuously altering. What one agent sees depends in part on what the others have already done.

The third change is an audit problem. Reconstructing a sequence of events from one agent is already difficult. Reconstructing which of several concurrent agents initiated which consequential action, in what order, against which system, requires correlating multiple activity streams that may not have been designed to be correlated.

From individual actions to sequences

Earlier this year, the OpenAI and Hugging Face incident showed how a single agent can produce a dangerous outcome through a chain of individually unremarkable actions. Hugging Face reconstructed approximately 17,600 actions from the intrusion. No single step was the problem. The sequence was.

The Taiwan operation extends that problem in a specific direction.

In the Hugging Face incident, the sequence belonged to one agent. In the Taiwan operation, if the reporting is accurate, the sequence was distributed across several. Agents worked different targets in parallel. When one route was blocked, another agent was dispatched to find an alternative. The platform continuously ranked and reprioritised attack paths based on what it was learning. The overall sequence was a product of what several agents did together, not what any one of them did alone.

Consider what this means for any system evaluating whether what has happened is acceptable. Evaluating an individual action against a policy is hard. Evaluating a chain of actions from one agent is harder. Evaluating what several agents are doing together, concurrently, and what those actions collectively amount to, is harder still.

The dangerous thing may not be any individual action by any individual agent. It may be what several agents are producing together through actions that each look defensible in isolation.

The "near-autonomous" versus "end-to-end autonomous" question

CyberScoop characterised the attack as "near-autonomous." Becker called it an "end-to-end autonomous attack." That difference is not a terminology dispute. It is the unresolved factual question at the centre of this incident.

If there was a human operator directing agents between sessions, deciding which target to pursue next or approving the expansion to the nuclear safety agency, then the incident is a story about capable humans with capable tools. The agents were executing, but authority remained concentrated.

If the platform made those decisions itself, then authority was genuinely distributed. The agents were deciding. The question of where authority lived becomes much harder to answer.

The available reporting does not resolve this. The phrase "minimal human steering" appears across multiple outlets, but "minimal" is not the same as "none." I do not know how much human direction was involved, and I am not going to pretend otherwise.

Where does the control boundary live?

In a single-agent system, the control boundary has a natural location: around the agent. What can it reach? What authority does it have? What prevents it from exceeding that authority?

When authority is distributed across several agents, locating that boundary is harder.

Which agent had authority to reach which system? Was that authority established per agent or inherited from the platform? If one agent found a path to a new target and another agent pursued it, which agent's authorisation applies? When the platform expanded from government systems to the nuclear safety agency and energy companies, was that expansion within scope or beyond it?

The reporting establishes that the expansion happened. It does not establish who or what authorised it.

The attackers, according to the reporting, also bypassed the underlying AI model's safety guardrails by framing the operation as an authorised penetration test. This is worth holding separately. The safety behaviour of the agent framework was not broken through a software vulnerability. It was redirected through a framing. The agent was told the activity was legitimate, and it proceeded. That is the same class of problem that appears in single-agent prompt injection, applied to a multi-agent platform. If an instruction can redirect what an agent treats as authorised, then the control question cannot be answered by examining the instruction alone.

What this means if you are deploying agents

You do not need anything resembling the Taiwan platform for the questions it raises to be relevant.

If you are running more than one agent against related systems, or running agents that can spawn sub-agents or delegate tasks, you have a version of this problem. The individual agent may be within scope. What several of them are producing together may not be. And the gap between those two things may not be visible until the sequence has already completed.

You do not need an attack to see this at commercial scale either. Robinhood now lets thousands of customers each connect a third party AI agent to place real trades and real purchases, concurrently, across the whole platform. The individual agent is contained. What several thousand of them are doing across the platform at once is a different question, and it is the one a real time activity feed answers only after the fact.

What I think is also important here is the asymmetry in evidence. An autonomous multi-agent platform produces the same kind of traces as a human team: login records, API calls, network events. But the volume and the distribution of that evidence across several concurrent actors makes reconstruction substantially harder. Understanding what happened requires understanding what each agent did, in what order, in response to what the other agents had already done.

Dream's Becker said the system behaved like a coordinated hacking team rather than a piece of malware. That description is useful precisely because it highlights the audit gap. A team produces outcomes through interaction. You cannot understand what a team did by examining what each member did independently.

The question I do not yet have an answer for

We have built a useful vocabulary for thinking about single-agent authority: what an agent can reach, what it can execute, what should require another decision before it happens, and what evidence should exist afterward. That vocabulary is still developing, but the shape of the problem is becoming clearer.

The Taiwan incident introduces a harder version: what happens when authority, execution, and the decisions about what to try next are distributed across several agents operating concurrently?

A system that evaluates individual actions cannot see the sequence. A system that evaluates one agent's actions cannot see what several agents are producing together. A system that examines authorisation cannot see the paths through shared environments that agents opened for each other.

When several agents can act at once, who is actually in control?

I think that question is now clearly on the table. I do not think we have a complete answer yet.