Single Operator Orchestrates AI Agents to Breach Emergency Services and Other Organizations Globally
A lone attacker has deployed a sophisticated network of 12 AI agents, dubbed BOSSAI, to conduct widespread cyberattacks across 11 countries, successfully exfiltrating sensitive data from emergency services, banks, universities, and military systems.
A single operator, identified as being based in Taiwan, has orchestrated a significant cyberattack campaign using a custom-built team of 12 AI agents named BOSSAI. This operation targeted hundreds of organizations across 11 countries, with confirmed data theft including sensitive medical and personal records from Taiwanese emergency services. The campaign highlights a new era of "AI-augmented threat actors," where an individual can leverage rented GPU power and open-source tools to mount operations previously requiring a dedicated team.
The BOSSAI mesh consisted of 12 AI agents, though only nine were actively engaged in the operation. These agents were assigned distinct roles: builder agents like Grok, OpenClaw, Claude Code, and Codex were responsible for setting up infrastructure such as servers, DNS, and proxies. Meanwhile, attack agents including Hermes, Cursor, Trae, and CyberStrike focused on scanning targets and developing exploits. Hermes, in particular, was highly active, managing approximately 95 sessions and sending over 18,000 messages, making it the primary workhorse of the attack.
Acronis Threat Research Unit discovered the campaign after investigating a misconfigured development server, which revealed a comprehensive attack platform. This platform contained over 90,000 files, approximately 9GB of logs, chat histories, exploit tools, and exfiltrated victim data. The AI agents did not communicate directly; instead, the operator manually transferred outputs between agents, acting as the central coordinator. This manual intervention, coupled with the AI's capabilities, allowed for a flexible yet potent attack strategy.
The technical execution involved agents like HalberdStrike scanning targets, such as a Taiwanese emergency-services website. The findings were then processed by Hermes into a report, which the operator fed into Cursor with instructions to exploit identified vulnerabilities. Cursor then executed the attack. The agents utilized various security tools and MCP servers, including HexStrike AI and a Kali Linux server, to facilitate their operations. Attack traffic was routed through proxies, with the main command node operating from a server at 112[.]121[.]185[.]218.
The impact in Taiwan was severe. A Taipei fire department platform exposed patient data, including ECG readings and vital signs from 2018, without requiring any login. Case records from a city 119 dispatch system were also compromised. Beyond Taiwan, the AI agents collected approximately 206,800 residential phone records in Mexico and targeted 489 universities in Thailand, exfiltrating data from three of them.
Despite the campaign's success, the AI agents faced limitations. Commercial models like Grok 4.5 and MiniMax M3 refused to participate in attacks without authorization, forcing the operator to switch to local, stripped-down models. These "abliterated" models were less capable and prone to errors, with significant issues like "hallucinations" leading to false positives. For instance, HalberdStrike incorrectly identified a failed connection as a critical remote code execution vulnerability.
However, the agents proved effective against systems with basic security weaknesses, such as open ports, unpatched databases, and default credentials. Where login checks and filtering were robust, the agents struggled. Acronis emphasizes that obscurity is no longer a viable defense, as AI agents can rapidly test vast numbers of targets. This aligns with broader trends, including reports of AI agents automating various stages of cyberattacks and previous instances of AI-driven espionage.
Acronis attributes the activity to a single individual in Hualien City, Taiwan, based on reused branding, GitHub accounts, and IP addresses across legitimate and attack infrastructure. Defenders are advised to patch exposed systems, eliminate default credentials, close unnecessary ports, and implement strong authentication for all APIs, especially those handling sensitive data. The same AI capabilities that enable these attacks will continue to exploit these vulnerabilities until fundamental security hygiene is addressed.