One hacker, 12 AI agents: how BOSSAI hit Taiwan's emergency services

What's going on

The Threat Research Unit (TRU) at security company Acronis has published an unusually well-documented AI attack campaign. A single attacker, whom the researchers place "with high confidence" in Hualien City, Taiwan, built a network of 12 AI agents. The researchers call it BOSSAI. With it, he went after hundreds of organizations in 11 countries: government emergency services, banks and lenders, universities, military systems, phone directories, online stores and gambling sites.

Confirmed breaches hit universities and emergency services, where medical data and personally identifiable information (PII, meaning names, contact details and the like) were stolen. The Taipei case is especially troubling: a fire department platform for ambulance patient records exposed ECG recordings, in-ambulance video and patient vital signs, with no credentials required at all. The data goes back to 2018.

The attacker was exposed by an apparently misconfigured development environment. There, the researchers found more than 90,000 files totaling 9 GB: agent conversation logs, the attacker's command histories, attack tools, credentials and victim data from several countries.

What was stolen

Besides the patient data, the agents pulled dispatch records from the city's 119 emergency system. These contain dispatch times, incident types, status fields and street-level locations for seven of Taipei's districts. Acronis stresses that these were dispatch records pulled from an application programming interface (API), not live ambulance tracking. According to other reports cited by gbhackers, the campaign also grabbed student data from Thai universities and more than 200,000 landline phone records from Mexico.

One documented example: at a Thai university, the system enumerated more than 50 subdomains, i.e. sub-addresses like "portal.uni.ac.th". It confirmed a blind SQL injection on a server running the ancient Oracle 9.2.0.4.0 database and then started exfiltrating student records. In an SQL injection, an attacker smuggles database commands into input fields. "Blind" means the attacker can only infer the responses indirectly. The researchers also found a custom C# program that can fully take over Hikvision surveillance cameras, including remote code execution via functions like keepAlive, applyCT and applyAutoLoginTicket.

How the agent network worked

According to Acronis, BOSSAI consists of 12 agents. Nine were active; three were set up but unused. Some of them built and maintained the infrastructure, namely Grok, OpenClaw, Claude Code and Codex. Others, such as Hermes, Cursor, Trae and CyberStrike, scanned targets and built exploits, i.e. programs that actually take advantage of a specific vulnerability.

The agents were wired to their tools through MCP servers. The Model Context Protocol is a standard that lets AI models operate external programs, a kind of universal power socket for tools. At its peak, 13 such servers were loaded. They gave the agents access to CVE databases (public lists of known vulnerabilities), OSINT research, cloud audits, binary analysis with Ghidra and Radare2, browser automation with Playwright and a Kali Linux install with classic hacking tools like nmap, sqlmap, Metasploit and Hydra. By the time of the investigation, this had shrunk to three servers: HexStrike AI, a Kali server and a Ghidra integration.

Strikingly, the agents didn't talk to each other directly. The attacker sat in the middle and copied results by hand from one agent to the next. He typed his commands in Traditional Chinese, often just a bare target address. Two agents were connected to messengers: Hermes to WeChat, OpenClaw ("Little Claw") to LINE. In one documented chain, the HalberdStrike agent scanned an emergency services target, Hermes summarized the findings, and Cursor ran the exploit on command. Hermes alone logged around 95 sessions and 18,311 messages.

Behind it all sat the attacker's own hardware: a machine with RTX 4090 graphics cards running local models via llama.cpp, plus short-term rented GPU capacity for larger models. Eight virtual servers handled gateway and proxy duties. Attack traffic was routed through a private SOCKS5 proxy pool and through BrightData datacenter proxies so it would appear to come from the right countries.

Commercial AI said no, so in came "abliterated" models

A key finding: the commercial models helped build the infrastructure, but according to Acronis they refused every request that involved finding or exploiting vulnerabilities. Several demanded proof that the work was legal and declined when none was provided. Chinese open-source models in their official form refused too, and even lectured the attacker on computer crime law. Acronis concedes it's unclear how the models would have responded if the attacker had simply presented a fake penetration testing contract.

So the attacker switched to "abliterated" models. These are open-weight models whose safety alignment has been deliberately stripped out so they no longer refuse anything. Specifically, he used variants of DeepSeek, GLM and Qwen on the local RTX 4090 cards. Over 19 days, Hermes cycled through at least nine models before settling on a DeepSeek V4 variant the attacker called "DS4". The system prompt gave the agents full autonomy, and every action was auto-approved.

Where the agents fell short

Acronis spends a notable amount of space on the failures, which it says are "heavily underreported". More than half of HalberdStrike's high or critical findings were false positives or misclassified. Some models invented CVE numbers, i.e. vulnerabilities that don't exist. The agents generated more data than one person could ever review.

All that autonomy had an ironic side effect. The agents were told not to bother the attacker, so they ignored a machine belonging to the Honduran military because they classified it as "out of scope". The local models were also weaker and limited by the available compute.

Background: Taiwan as a target of AI attacks

BOSSAI isn't the first case of its kind in Taiwan. In August, Taiwan's Ministry of Digital Affairs reported AI-assisted attacks on government agencies since July 20, a mix of manual work and agents like OpenClaw. Israeli firm Dream attributed another campaign to suspected Chinese actors, in which 85 credentials and more than 2,564 personnel records were reportedly stolen. Taiwan has since set up a task force against AI cyber threats.

Acronis is introducing a new category for cases like this: the "AI-augmented threat" (AAT). It describes a lone actor with the reach of an APT, normally a well-resourced, often state-backed hacking group, but with no apparent political or financial goal. Acronis suspects the attacker wanted to compromise as many organizations as possible and monetize that access later. The researchers have published IP addresses and domains that can be used to detect the attacks (indicators of compromise), including several subdomains of xs1.ccwu.cc.

Our take

This case matters because it's a rare complete look at what a multi-agent attack system looks like in practice, from the config files to the chat logs. Two takeaways stand out. First, the guardrails on commercial models apparently work. But they only push the problem toward freely downloadable models whose safeguards can be removed, and those run on gaming GPUs. Second, the agents are far from infallible super-hackers: lots of false positives, invented vulnerabilities and questionable decisions.

Acronis also stresses that the affected systems were poorly protected long before any AI showed up: a port exposing medical data since 2018, dispatch logs on a public API, a bank with 16 SQL injection points and unpatched Oracle databases. The agents didn't create these holes. They just found them faster and more systematically than a human could. So the advice for defenders is fairly classic: clean up legacy systems, put authentication on public APIs and watch for fast, automated scanning. Keep in mind, too, that every claim here, including the attribution to a lone actor, comes from a security vendor that sells its own protection products. The sources contain no independent confirmation.