Hackers deployed the BOSSAI network composed of 12 AI agents, attacking hundreds of organizations worldwide

The Acronis Threat Research Unit (TRU) disclosed that one operator used the BOSSAI network composed of 12 AI agents to attack hundreds of organizations in 11 countries, with targets including government emergency services, banks, universities, military systems, e-commerce websites and gambling platforms. The operation was discovered due to a misconfigured exposed development environment, which contained more than 90,000 files, 9GB of logs, agent conversations, exploitation tools, credentials and victim data. The main attacks were carried out by Hermes, with about 95 sessions and 18,311 messages, invoking sqlmap, nmap and nikto through a Kali Linux server. The agents did not communicate with each other, and the operator had to manually copy results from one agent to another. Commercial models refused to assist with the attacks; Grok 4.5 and MiniMax M3 required written authorization and were used only to set up infrastructure; the attack agents ran on local open-source models with safety controls removed.