BOSSAI: How One Hacker Used 12 AI Agents to Steal Taiwan Emergency-Services Data

In early November 2026, Acronis's Threat Research Unit (TRU) published an investigation offering one of the most detailed looks yet at what an attack orchestrated by a single operator using a network of AI agents looks like. The campaign was named BOSSAI — a "mesh" of 12 AI agents controlled by one person from the city of Hualien, Taiwan.

Over weeks, this network attacked hundreds of organizations in at least 11 countries — targets included emergency services, banks and lenders, universities, military systems, phone directories, e-commerce platforms, and gambling sites. Confirmed intrusions and data theft were recorded in about 10 organizations in three countries — Taiwan, Mexico, and Thailand — with roughly 15 more targets actively attacked but without confirmed compromise.

Researchers stumbled on the campaign almost by accident: what first looked like a misconfigured developer environment turned out to be a full attack-operations platform. It held over 90,000 files totaling about 9 GB — attack-orchestration logs, AI-agent conversations, the operator's command history, exploits, credentials, and victim data. This gave researchers end-to-end visibility into the whole operation: from config files to internal communications.

Emergency-services data: what exactly was stolen

The most serious confirmed damage concerns Taiwan, which was attacked far more intensively than other countries. Agents reached the 119 emergency-call system — Taiwan's fire and ambulance number — and pulled dispatch-service records through its API. These were call cards with incident times, response types, case statuses, and street-level addresses across seven Taipei districts. Importantly: these are archived API cards, not live tracking of ambulance movement — but it's still confirmed exfiltration of critical emergency-response data.

Separately, agents found the Taipei Fire Department's patient-records platform, which was open with no authentication at all. It held medical data dating back to 2018: ECG readings, ambulance videos, and patient vital signs — all accessible without a login.

Beyond that, agents attacked five more Taiwan emergency-services targets. A fire-dispatch technology vendor was breached via default root credentials in a database admin panel, gaining access to 18+ tables. In another emergency-management system, a hardcoded AES-256 key was found in front-end JavaScript, revealing session-cookie contents including administrator identity. And to a national disaster-response center, an agent attributed a critical Apache RCE vulnerability that… didn't actually exist.

How the "AI-augmented" attack works

Acronis proposes a new term for such operations — AI-augmented threat actor (AAT). This isn't a classic APT with a large team and state-level resources, but one person who uses AI to take on technical complexity that would previously have required a whole group.

The BOSSAI network consisted of 12 agents (9 active at the time of research), each with its own role. Builders — Grok, OpenClaw, Claude Code, Codex — assembled and maintained the infrastructure itself: MCP connections, DNS, proxies, messenger gateways. Attackers — primarily Hermes, plus Cursor, Trae, and CyberStrike — scanned targets and built exploits. A separate scanning layer — the agent HalberdStrike and a cracked Acunetix installation — generated structured vulnerability reports.

A key detail: the agents didn't talk to each other directly. The operator was the "bridge," manually copying one agent's results into another. In one documented case, HalberdStrike scanned a Taiwanese emergency-services target, Hermes consolidated the findings into a single report with attack-path analysis, and the operator pasted that report into Cursor with "help me exploit these vulnerabilities" — and it carried out the attack.

The whole construction was connected by servers speaking the Model Context Protocol (MCP). At peak, the network ran 13 MCP servers providing tools for GitHub security, CVE search, OSINT, cloud auditing, binary analysis via Ghidra and Radare2, browser automation via Playwright, and a Kali Linux wrapped in MCP with nmap, sqlmap, Metasploit, and Hydra. Behind the scenes — a GPU fleet: a main host with an RTX 4090 for local models via llama.cpp, rented GPUs for larger models, eight VPS nodes, and proxy layers (SOCKS5 and BrightData datacenter proxies for egress geolocation).

Abliterated models: when safety limits are stripped

A separate — and perhaps the most alarming — part of the story is the models running the network's "offensive core." The agents that directly executed attacks almost exclusively ran on abliterated models — locally run open models from which safety alignment had been artificially removed. In BOSSAI these were "stripped" variants of open DeepSeek, GLM, and Qwen models — Chinese open-source models fine-tuned to stop refusing malicious instructions.

The main attack agent Hermes changed at least nine models over 19 days, testing each on real tasks and keeping or replacing them within hours. The final choice was "DS4" — an abliterated DeepSeek-V4 variant with a 64K context on local GPUs. In total about 95 sessions and 18,311 messages passed through Hermes, 83.5% of them direct tool calls.

The operator further reinforced model "obedience" with system prompts. Hermes's identity file explicitly ordered the model never to refuse "legitimate technical discussion," never to moralize, never to deflect, and never to say "as an AI I can't." It also had outright criminal guidance like "don't write test scripts — go straight at the target" and "the more serious, the more $$$$."

Commercial models refused — and that matters

At the same time, the investigation shows that commercial AI models' safeguards work. The commercial models — the very ones the operator happily used for infrastructure-building — repeatedly refused requests to identify and exploit vulnerabilities. Some asked the operator to prove the action was lawful, and when proof was absent, refused. Chinese commercial open-source models also refused hacking instructions and even lectured the operator about cyber laws.

That's exactly why the operator switched to local abliterated models — less powerful and resource-constrained, but without built-in safeguards. This is an important nuance for understanding the threat landscape: the danger comes less from commercial chatbots than from open models with removed restrictions, runnable locally with no oversight. Openness is both a boon for researchers and raw material for attackers who can "strip" a model for their tasks.

What went wrong for the attacker

Despite the scale, BOSSAI isn't a story of flawless automation. Researchers recorded plenty of failures, refusals, and hallucinations.

The most telling example is a hallucinated vulnerability. An agent generated a confident, structured report about a critical Apache RCE in one Taiwanese target — but that vulnerability didn't exist. This is a perfect illustration of the main risk of autonomous agents: they produce giant volumes of information that one operator can't keep up with verifying, and truth and falsehood both get lost in that noise.

Another ironic failure is excessive autonomy. The operator told the agents "don't bother him" and gave them full decision freedom. As a result, Hermes, while collecting Mexican data, stumbled on a Honduran Air Force personnel military system, scanned it a bit, and left — because, per the model's own reasoning, the target was "outside the task scope." Had the operator known, they might have gone further.

There were also direct failures: brute-forcing a Mexican WooCommerce store (~260,000 records) didn't work, and XML-RPC credential stuffing against a Mexican news site (2,600+ combinations) produced no valid login. Agents fell where authentication was implemented, where a paywall required a valid session, and where endpoints were properly filtered.

How to defend against AI-agent attacks

The study's main conclusion for defenders is paradoxical: AI doesn't "conjure" access where defense holds. Agents made target discovery cheap and parallel, but the vulnerabilities themselves are old and well-known: default root passwords, unauthenticated open APIs, hardcoded front-end encryption keys, unpatched Oracle databases, and SQL injections. This is a story of vulnerabilities older than any AI agent — what's new is the speed and systematicity with which they're now found.

Hence the practical takeaways:

• "Obscurity isn't security." Agents can scan dozens of subdomains and hundreds of targets simultaneously (489 potential targets across 45 institutions in Thailand alone). Hiding a service is no longer enough — you need real visibility into your own exposed services.
• Close classic holes first. Default credentials, SQL injections, unpatched legacy systems — that's exactly how agents got in. Patch management and enforced authentication stop most such attacks.
• Monitor anomalous activity. Mass systematic scanning, sudden API request spikes, subdomain enumeration — these are detectable patterns.
• Distinguish confirmed compromise from noise. Automated AI reports often contain hallucinations and false findings. Every signal from autonomous tools needs manual validation before response.
• Watch your leaks. If your organization's data is already "roaming" the web, check it via the breach-check tool, and strengthen the team with skills for new AI threats — start with the cybersecurity learning base.

Conclusion

BOSSAI is a window into the near future of cyber threats. One person with access to open models, GPUs, and MCP tools was able to run campaigns whose scale resembles the work of an entire APT group: state networks, emergency services, and military systems — through espionage, data theft, and opportunistic intrusion. Acronis introduces a separate class for this: the "AI-augmented threat actor."

But the same story also shows this threat's limits. Commercial models resist malicious instructions, abliterated models are less capable and prone to hallucination, and unsupervised autonomy leads agents to miss the most valuable targets on their own. Attacks get faster and cheaper, but not "magical": they still rely on weaknesses that can — and must — be closed.

For Ukraine, which has lived under cyberwar for years, the lesson is direct: the next generation of attacks won't necessarily come from a state group — it can come from one motivated person with properly configured AI agents. And the best answer is not exotic AI tools but basic cyber hygiene, patch discipline, and proper authentication, which even today stop most such campaigns.