One Hacker Used 12 AI Agents to Target Taiwan's Emergency Services

A single hacker used a network of 12 AI agents to target hundreds of organizations, exposing sensitive emergency-response information in Taiwan and compromising university and financial systems.

Cybersecurity firm Acronis uncovered the operation, known as BOSSAI, and traced it to a Taiwan-based operator who coordinated AI tools to scan networks, identify vulnerabilities, and attempt unauthorized access. The campaign reached organizations across 11 countries, although only a fraction of the attempted attacks resulted in confirmed compromises.

The investigation shows how one person can use AI to conduct cyberattacks on a scale previously associated with larger operations. It also exposes the technology's limitations, including fabricated vulnerabilities, failed exploitation attempts, and commercial AI models refusing malicious instructions.

BOSSAI combined 12 AI agents into one attack operation

According to the Acronis Threat Research Unit (TRU), BOSSAI consisted of 12 AI agents, nine of which were active during the investigation.

The agents had different responsibilities. Some built and maintained the attack infrastructure, while others conducted reconnaissance, analyzed vulnerabilities, developed scripts, and attempted exploitation.

Hermes handled most of the offensive activity, supported by tools such as HalberdStrike for vulnerability assessments, Cursor and Trae for code development, and CyberStrike for additional security testing.

Similar AI-assisted attack activity emerged in Japan, where CyberStrikeAI used 44 AI agents to target organizations through automated reconnaissance, exploitation attempts, and reporting. Researchers have not established a connection between the two operations.

The operator connected these systems to penetration-testing tools through Model Context Protocol (MCP) servers, allowing agents to invoke scanners, vulnerability-analysis utilities, and exploitation frameworks.

However, the agents did not communicate directly with one another. Acronis found that the operator frequently copied results between AI interfaces to coordinate different stages of an attack.

In one case involving Taiwanese emergency services, HalberdStrike generated a vulnerability report that the operator passed to Hermes for analysis. The findings were then transferred to Cursor with instructions to exploit the identified weaknesses.

The setup allowed one person to divide complex operations among specialized tools, reducing the need to perform every technical task manually.

Taiwan emergency systems exposed medical and dispatch records

Taiwan experienced the heaviest targeting, particularly across emergency services, government systems, and financial institutions.

The findings add to Taiwan's concerns about AI-assisted intrusions, following an earlier investigation into AI-agent cyberattacks targeting government networks that involved coordinated tools and traditional hacking techniques. The incidents have not been established as connected.

Acronis identified a Taipei fire department emergency patient-care platform that exposed medical information without requiring authentication.

The accessible records were from 2018 and included electrocardiogram readings, ambulance video footage, and patient vital signs.

Separately, BOSSAI agents accessed a city's 119 emergency-dispatch system and extracted case records covering seven Taipei districts.

The stolen information included incident times, response categories, case statuses, and street-level locations.

Researchers clarified that the records did not provide real-time GPS tracking of ambulances. Nevertheless, they contained sensitive operational information about emergency responses.

Other attacks against Taiwan's emergency infrastructure produced mixed results.

An emergency-management system contained a hardcoded AES-256 encryption key in frontend JavaScript, exposing session-cookie contents that included an administrator identity. Acronis also identified a partial server-side request forgery path, but did not confirm a complete compromise.

Meanwhile, a scan of a national disaster-response organization incorrectly reported a critical Apache remote-code-execution vulnerability. Further examination found no evidence supporting the finding.

The confirmed exposures highlight familiar security weaknesses, particularly insufficient API access controls, exposed sensitive information, and insecure application configurations.

Attacks extended to universities and financial institutions

BOSSAI's activities extended across 11 countries, according to Acronis, although the level of targeting varied significantly.

During a 12-day observation period, researchers identified confirmed unauthorized access or data extraction at approximately 10 targets across three countries. Around 15 additional targets experienced active attacks without confirmed compromise.

Thailand was another major focus.

The agents identified 489 potential targets across 45 universities and conducted automated SQL-injection testing. Acronis confirmed data extraction at three institutions, while two others had verified injection vulnerabilities without confirmed data theft.

At one university, an agent accessed an administrator database table containing 2,563 rows and attempted to extract student records.

In Taiwan, agents exploited SQL injection against a lending-services company's database and extracted account information. They also accessed a fire-dispatch technology vendor's database administration interface using default root credentials.

The operator pursued a different objective in Mexico, directing agents to collect residential information. One operation produced approximately 206,800 phone records associated with names, addresses, and postal codes, while a separate directory-scraping effort collected roughly 124,000 records.

The Mexican operations involved data collection and scraping rather than confirmed breaches of the underlying systems.

Acronis also identified reconnaissance involving military-related systems and organizations in other countries, but many of those operations never progressed to confirmed exploitation.

The findings illustrate the reach of automated targeting without establishing that every investigated organization was compromised.

Commercial AI models refused attacks, forcing a shift to modified systems

Acronis also documented repeated attempts to convince commercial AI models to participate in unauthorized cyberattacks.

Researchers observed Grok and MiniMax M3 refusing offensive requests, often demanding proof of authorization before assisting with penetration testing.

The operator consequently relied on locally hosted models modified to remove safety restrictions, commonly known as abliterated models, for much of the direct exploitation.

These included modified variants of DeepSeek, GLM, and Qwen.

Commercial models still assisted with infrastructure development and troubleshooting. However, the researchers found that the models they observed generally refused requests to conduct unauthorized attacks directly.

The modified local models were more willing to follow those instructions, but their outputs were often unreliable and required additional troubleshooting.

The findings suggest that commercial AI safeguards created obstacles for the operator, even though access to modified models and existing security tools allowed the broader operation to continue.

AI agents fabricated vulnerabilities and missed potential targets

BOSSAI's automation also created problems for its operator.

According to Acronis, more than half of HalberdStrike's high-severity and critical vulnerability findings were false positives or misclassifications.

Some agents incorrectly treated failed connection attempts as evidence of serious security flaws, producing detailed reports that appeared credible despite lacking technical support.

The agents also made decisions that worked against the attacker's objectives.

During reconnaissance involving Mexican phone directories, Hermes encountered a Honduran military personnel system but abandoned further exploitation after determining that the target fell outside its assigned scope.

The operator had instructed the agent to make decisions independently without requesting repeated approval.

While this reduced manual intervention, it also meant the attacker could overlook potentially valuable findings or waste time investigating nonexistent vulnerabilities.

Acronis reported that the agents generated substantial volumes of information, making it difficult for one operator to monitor every action and evaluate the results.

The investigation demonstrates that autonomous AI can expand an attacker's reach without guaranteeing accurate analysis or successful exploitation.

What security teams should learn from BOSSAI

BOSSAI's confirmed compromises largely involved existing security weaknesses rather than previously unknown vulnerabilities.

Exposed emergency records, SQL-injection flaws, and default credentials gave the agents opportunities to access information that should have been protected.

For organizations responsible for critical infrastructure and sensitive data, the findings reinforce several defensive priorities:

• Secure public-facing APIs. Require authentication and enforce authorization checks to prevent access to sensitive records.
• Review legacy systems. Identify outdated databases, exposed services, and applications that may remain accessible without adequate protections.
• Remove default credentials. Restrict administrative interfaces and enforce strong authentication across management systems.
• Monitor automated reconnaissance. Investigate unusual scanning activity, repeated login attempts, and suspicious requests against public-facing infrastructure.
• Validate vulnerability findings. Confirm suspected flaws with supporting technical evidence rather than relying entirely on automated assessments.

Organizations deploying their own AI agents should also limit tool permissions, monitor execution, and require human approval for sensitive operations.

BOSSAI demonstrates how a single operator can combine AI agents and existing security tools to attack organizations across multiple countries. Yet the investigation also shows that many attempts failed, with agents fabricating findings or abandoning targets.

For defenders, the immediate concern is not that AI has made every system vulnerable. It is that attackers can now search for existing weaknesses across more targets with less manual effort, making strong access controls, continuous monitoring, and timely remediation increasingly important.

Other news: Hackers are exploiting a critical Node-RED vulnerability (CVE-2026-58115) to deploy malicious automation flows and persistent backdoors, prompting Siemens to urge affected SIMATIC IoT2050 users to update their systems and strengthen access controls.