Category: AI Agent Security | Reading time: 3 min
Acronis's Threat Research Unit published research on November 4 describing a single attacker who used a set of AI agents, called BOSSAI, against hundreds of organizations in at least 11 countries. The agents pulled emergency dispatch records covering seven Taipei districts and found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video, with no login required. The Hacker News reported the findings on November 9.
How the research came together
The evidence came from the attacker's own server, which first looked like a misconfigured development system. It held more than 90,000 files, including the agents' conversations, the operator's command history, hacking tools, credentials and victim data. Acronis is highly confident the operator is one person based in Hualien City, Taiwan, based on an identity he reused across his legitimate businesses and his attack servers.
What the agents reached
BOSSAI had 12 agents, 9 of them in use. Some built and maintained infrastructure; others scanned and attacked. They collected data or accessed systems at about 10 organizations in Taiwan, Mexico and Thailand:
- Taipei 119 dispatch: case records pulled from a public-facing API, with incident times, response types, case status and street-level locations. - Fire-dispatch vendor: database admin access through default root credentials, covering 18 or more tables. - Taiwanese lender: an account table pulled through SQL injection. - Thai universities: data from three universities, after the agents lined up 489 potential targets across 45 institutions. - Mexico: about 206,800 home phone records with names and addresses.
About 15 more organizations were attacked without a confirmed break-in. The report does not say whether victims or Taiwan's authorities were notified.
Where the agents failed
Commercial models mostly refused direct attack requests, and some asked for written proof of authorization. The operator ran the attacks on locally hosted models with their safety training removed. The tooling was also unreliable: one scanner invented CVEs, more than half of its high and critical findings were false or misclassified, and the main attack agent reported results that never happened. The agents only succeeded where defenses were already weak, and failed wherever logins were enforced and endpoints were properly filtered.
Why it matters
The case shows AI lowering the cost of finding and reaching many weak targets at once, not breaking strong controls. It also shows how unreliable an agent's own account of its work can be: the attack agent claimed results that did not exist. For organizations running agents of their own, a record of what an agent actually did, kept outside the agent, is more trustworthy than the agent's report.
Source: Acronis TRU: BOSSAI research (Nov 4) | Acronis blog recap | The Hacker News (Nov 9)