A single operator in Taiwan built a team of 12 AI agents and used it to attack hundreds of organizations in 11 countries. The campaign hit emergency services, banks, universities, and military systems. It led to confirmed theft of medical data and personal records.

The setup, named BOSSAI, shows how one person with rented GPUs and open-source tools can now run a campaign that once needed a full team.

Some of the agents wrote code, some scanned websites, and some carried out the attacks. The operator sat in the middle and passed results between them.

Analysts at Acronis Threat Research Unit identified the campaign after finding what looked like a misconfigured development server. It turned out to be a full attack platform with more than 90,000 files, about 9GB of logs, chat histories, exploit tools, and victim data.

Acronis calls this kind of actor an “AI-augmented threat,” because the activity looks like a state-backed group but comes from one person, as Acronis explains in its full report.

One Hacker Uses 12 AI Agents

The mesh had 12 agents, but only nine were active. Builder agents such as Grok, OpenClaw, Claude Code, and Codex set up servers, DNS, and proxies.

Attack agents such as Hermes, Cursor, Trae, and CyberStrike scanned targets and wrote exploits. Hermes did most of the work, with about 95 sessions and 18,311 messages.

The agents did not talk to each other. The operator copied output from one tool and pasted it into the next. In one case, a scanner called HalberdStrike checked a Taiwanese emergency-services site.

The BOSSAI mesh is composed of 12 AI agents working together in different roles (Source - Acronis) — The BOSSAI mesh is composed of 12 AI agents working together in different roles (Source – Acronis)

Hermes turned the findings into a report, and the operator pasted it into Cursor with the order to exploit the flaws. Cursor then carried out the attack.

The agents were linked to security tools through MCP servers, including HexStrike AI, a Kali Linux server, and a Ghidra bridge.

Earlier coverage of the HexStrike AI framework shows how this kind of tool lets AI models run scanners such as Nmap on their own. Attack traffic went out through proxies, and the main node ran on a server at 112[.]121[.]185[.]218.

The damage in Taiwan was serious. A Taipei fire-department patient-care platform exposed ECG readings, ambulance video, and vital signs from 2018, with no login needed.

Agents also pulled case records from a city 119 dispatch system, covering seven districts. Other victims included a lender with 16 SQL injection points and a fire-dispatch vendor whose database panel still used default root credentials.

Outside Taiwan, the agents collected about 206,800 residential phone records in Mexico. In Thailand they found 489 targets across 45 universities and pulled data from three of them.

Why the AI Agents Struggled and What It Means for Defenders

The campaign was far from smooth. Commercial models such as Grok 4.5 and MiniMax M3 refused to help with attacks and asked for proof of written authorization.

The operator then switched to local “abliterated” models, which have their safety rules stripped out. Those models were weaker and often made mistakes.

Hallucinations caused real problems. HalberdStrike flagged a failed connection as a “critical RCE,” and more than half of its high-severity findings were false positives.

Since the operator told the agents to work without asking questions, Hermes also walked away from a Honduran military system, judging it out of scope.

Still, the agents worked well where basic security was weak. Old open ports, unpatched Oracle databases, and default passwords were the easy wins.

The BOSSAI mesh in further detail (Source - Acronis) — The BOSSAI mesh in further detail (Source – Acronis)

Where login checks and filtering held, the agents failed. Acronis notes that hiding behind obscurity no longer helps when an agent can test hundreds of sites at once.

This fits a wider trend. Anthropic recently warned that AI agents can automate every stage of a cyberattack, though humans still pick targets.

The first large-scale AI-driven espionage case from 2025 showed Claude doing most of an intrusion with little human input.

Researchers have also seen agents try SQL injection and path traversal on their own when normal methods failed. Defenders should patch exposed databases, remove default credentials, and close old ports.

They should also put login checks in front of every API, including those that serve dispatch and medical data. The same agents that find flaws quickly will keep finding them until those basics are fixed.

Acronis also tied the activity to one person in Hualien City, Taiwan. The operator reused business branding, a GitHub account, and a home IP across both legitimate and attack servers. The researchers assess this with high confidence.

Indicators of compromise (IoCs):-

Type	Indicator
IP	112[.]121[.]185[.]218
IP	156[.]240[.]109[.]26
IP	49[.]158[.]237[.]136
IP	202[.]160[.]76[.]153
IP	202[.]160[.]76[.]154
IP	202[.]160[.]76[.]155
IP	202[.]160[.]76[.]156
IP	202[.]160[.]76[.]157
IP	202[.]160[.]76[.]174
Domain	vps[.]xs1[.]ccwu[.]cc
Domain	xss[.]xs1[.]ccwu[.]cc
Domain	c[.]xs1[.]ccwu[.]cc
Domain	attacker-collector[.]com
Domain	boss[.]jytian[.]cc[.]cd
Domain	gdp[.]gasjy[.]kdns[.]fr
Domain	gds[.]gasjy[.]kdns[.]fr
Domain	888[.]bossjy[.]kdns[.]fr
Domain	ssh[.]gputw[.]ai

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post One Hacker Uses 12 AI Agents to Breach Taiwan’s Emergency Services and Steal Sensitive Data appeared first on Cyber Security News.