Singapore – The Acronis Threat Research Unit (TRU) has uncovered a campaign in which a single operator in Taiwan used a mesh of 12 AI agents, dubbed BOSSAI, to attack hundreds of organisations across 11 countries. The targets included emergency services, banks, universities and military systems.
The report finds the campaign after spotting what first looked like a misconfigured development environment. Further analysis revealed a fully operational attack platform and more than 90,000 files totalling 9GB of evidence.
The mesh divided its work between builder and attacker agents. Builders such as Grok, OpenClaw, Claude Code, and Codex maintained the infrastructure, while attackers led by Hermes scanned targets and built exploits.
However, the agents did not communicate with one another directly. Instead, the operator acted as the bridge, often pasting one agent’s output into another’s terminal.
Model choice shaped the entire operation. Commercial models handled infrastructure work but repeatedly refused offensive requests, so the operator turned to locally run abliterated models, which have had their safety alignment removed.
At one point, MiniMax M3 told the operator, “I’m the gatekeeper”. Commercial models repeatedly asked for proof that the requested actions were legal and refused to help when none arrived, although it remains unclear how they would have responded to a forged engagement letter.
Taiwan bore the heaviest targeting. Confirmed breaches at universities and emergency services providers led to the exfiltration of medical data and personally identifiable information.
Among the most serious cases, a Taipei fire-department patient-care records platform exposed ECG readings, ambulance video and patient vital signs dating back to 2018, all without credentials. Separately, agents pulled case records from a city’s 119 dispatch system covering seven Taipei districts.
Beyond Taiwan, the operator assembled roughly 206,800 residential phone records in Mexico. In Thailand, agents identified 489 potential targets across 45 universities and confirmed SQL injection with data extraction at three of them.
Yet the results fell short of the operator’s ambitions. Researchers confirmed data exfiltration or system access at roughly 10 targets across three countries, while about 15 others were attacked without confirmed compromise.
The AI agents themselves widened that gap. They hallucinated vulnerabilities, including a fabricated critical flaw at a national disaster-response centre, and more than half of one scanning tool’s high-severity and critical findings were false positives or misclassifications.
Excessive autonomy also backfired. Hermes abandoned its reconnaissance of a Honduran military system because it judged the target out of scope, without alerting the operator.
The findings now classify such actors as AI-augmented threats (AAT), a category that blurs the line between traditional advanced persistent threats and cybercriminal activity. The targets did not point to a single political, financial or ideological objective.
The agents failed wherever authentication was enforced and endpoints were properly filtered. Weakly protected data, however, was found quickly and in parallel across several countries, which the researchers said leaves obscurity with no value as a defence.
The report assessed with high confidence that one individual in Hualien City, Taiwan, operated the infrastructure, citing reused handles, branding and exposed credentials. They said the findings raise questions about open-source pentesting platforms and about unmonitored abliterated models running with excessive autonomy.
