A hacker used 12 AI agents to breach Taiwan's emergency services systems and steal sensitive data
One Hacker Uses 12 AI Agents to Breach Taiwan's Emergency Services and Steal Sensitive Data
The Acronis threat research team disclosed an attack campaign codenamed BOSSAI: an operator in Taiwan assembled 12 AI agents (9 active) to attack hundreds of organizations in 11 countries, with confirmed theft of medical data and personal records. Grok, OpenClaw, Claude Code, Codex and others were responsible for setting up servers and proxies, while Hermes, Cursor and others were responsible for scanning and carrying out attacks; the operator manually passed results between agents, and the agents invoked security tools via MCP servers such as HexStrike AI. A Taipei fire department patient care platform exposed ECG readings, ambulance video and vital signs dating from 2018 without requiring login; about 206,800 residential phone records were collected in Mexico; and data from 3 of 45 universities in Thailand was pulled. Grok 4.5 and MiniMax M3 refused to assist with the attack, and the operator switched to local models with safety restrictions removed, but more than half of the high-severity findings from the scanner HalberdStrike were false positives.
The report shows that a single person using open-source tools and local models with safety restrictions removed can sustain multi-country attacks, while the compromised targets mostly fell to basic flaws such as default passwords.