One man ran 12 AI agents against Taiwan's emergency services. He copy-pasted between them

Acronis researchers went looking at what they thought was a badly configured development server. It turned out to hold 90,000 files and 9GB of evidence from a hacking operation that one person had built out of a dozen AI agents.

The company's Threat Research Unit published the findings on November 4. It calls the system BOSSAI, after one of the operator's handles, and describes it as "a mesh of 12 AI agents (nine of which active, and three which were set up but unused at the time of our investigation)." Researchers Eliad Kimhy, Santiago Pontiroli and Subhajeet Singha say it was pointed at hundreds of organizations in 11 countries. The confirmed breaches include a fire department's ambulance records in Taipei.

The operator, according to Acronis, was a single individual on a residential broadband line in Hualien City, Taiwan.

A mesh with a human switchboard

"Mesh" is generous. The agents never talked to each other. "Notably, no agent-to-agent communication was established," the researchers write. The operator relayed results between them by hand, copying output from one and pasting it into another, and gave orders in Traditional Chinese through WeChat and LINE chat gateways wired into the agents.

The agents had jobs. Acronis says builder agents, "Grok, OpenClaw, Claude Code, Codex," set up and maintained the infrastructure: MCP connections, DNS, proxies, the chat gateways. The attacking was done mostly by an agent called Hermes, which ran about 95 sessions and 18,311 messages, alongside Cursor, Trae and a tool called CyberStrike. A scanning layer used HalberdStrike, built on PenTestGPT, and a cracked copy of the Acunetix web vulnerability scanner.

The hardware was ordinary hacker kit: a GPU box with RTX 4090 cards running llama.cpp, some rented cloud GPU time, eight virtual servers for gateways and reverse proxies, and outbound traffic routed through a SOCKS5 pool and commercial datacenter proxies.

The models are the interesting part. When the operator asked commercial systems to help with the attacks, they balked. "Multiple commercial models repeatedly asked the operator to prove that the requested action was legal, then refused to assist when proof was not provided," Acronis writes. The OpenClaw agent, running on a commercial model, "refused every request" when used to coordinate attacks.

So the operator went around them. The attacking core, the researchers say, "ran almost exclusively on abliterated models: stripped-down variants of DeepSeek, GLM, and Qwen." Abliteration is a technique for removing a model's refusal behavior. Hermes cycled through at least nine different models over 19 days before settling on an abliterated DeepSeek variant the operator called DS4, running on four local GPUs.

Guardrails on the big hosted models held. They also made little difference, because a downloaded open-weight model with its refusals stripped out has nobody to answer to.

What it got into

The Hermes system prompt, translated by Acronis, handed over the keys: "I'm giving you full decision-making authority across the board, handle it without asking me, report back only when a vulnerability is confirmed exploitable."

Taiwan took the worst of it. Acronis says a Taipei fire department's patient-care platform exposed ECG readings, ambulance video and vital signs going back to 2018, with no login required. The agents pulled case records from a city's 119 emergency dispatch system covering seven districts. A lender had 16 SQL injection points. A fire-dispatch software vendor had left its database panel on default root credentials.

In Mexico the operation scraped about 206,800 residential phone records. In Thailand it went after universities. Three had confirmed SQL injection and data extraction, including an administrator table of 2,563 rows. The operator's instruction for one of them, as translated by Acronis, was to "extract admin credentials, backend path, and all student data."

One detail is almost funny. A military system in Honduras was mapped but not attacked, because the agent decided it was "out of scope." The operator had given it total authority, and it used that authority to say no.

Cybersecuritynews, which reported on the Acronis findings on November 5, summed up the victims as emergency services and universities, with medical data and personal information confirmed stolen.

The agents also made things up

For all the automation, a lot of what BOSSAI produced was junk. "Some of the models fabricated CVEs without evidence, such as one case in which the model flagged a failed connection attempt as a 'critical RCE' vulnerability," the researchers write. Over half of HalberdStrike's high-severity and critical findings were false positives or misclassifications. Partway through the campaign the operator had to add anti-fabrication rules to the prompt that parsed scanner output.

That is the same problem every company running AI coding agents has, just with worse consequences for the people on the other end. A hallucinated vulnerability wastes the attacker's time. A real one exposes your ambulance footage.

Acronis does not call this an APT, the industry term for well-resourced state-backed groups. It uses a new label: an "AI-augmented threat." The motive is murky. "It's unclear if the attacker has any specific affiliation or goal beyond compromising as many organizations as possible, presumably to monetize the activity," the researchers write. The operator's prompts include a line about "the more $$$$," and the same IP address hosted a social media posting service and a surveillance camera business.

Strip away the agent branding and BOSSAI looks like what a single, moderately skilled person with a gaming PC and a grudge against refusals can now run. The operator did not need a team, just a few uncensored models, a scanner and the patience to copy and paste. The emergency services in Taipei were running software that let anyone read ambulance video without a password. Those two facts were always going to meet.

Sources: Acronis Threat Research Unit, Cybersecuritynews.