A single attacker based in Taiwan ran a network of 12 AI agents against hundreds of organisations in 11 countries. The agents pulled emergency dispatch case records covering seven Taipei districts from a city's 119 fire and ambulance dispatch system. Acronis's Threat Research Unit (TRU) published the findings on November 4 and calls the operation BOSSAI. The same investigation found a Taipei fire department patient-care platform that exposed ECG readings, patient vital signs and ambulance video going back to 2018 without asking for a login. According to The Hacker News, the agents collected data from or got into systems at about 10 organisations in Taiwan, Mexico and Thailand. Acronis describes confirmed breaches at universities and emergency service providers in which medical data and personal information were stolen. The Taipei City Government and its fire department have not commented publicly, and no Taiwanese regulator or CERT statement has been published.
What Happened
Acronis says TRU found the operation through what first looked like a misconfigured development server. It turned out to be the attacker's working attack platform. Acronis says investigators went through more than 90,000 files, about 9GB in total. These included the agents' conversation logs, the operator's command history, hacking tools, stolen credentials and victim data.
Acronis says only that the operator is based in Taiwan. The Hacker News goes further and reports that the researchers are highly confident the attacker is one person working from Hualien City. No law enforcement agency has publicly confirmed the attribution, made an arrest or filed charges.
The target list covered emergency services, banks, universities, military systems and e-commerce sites. Every account agrees that Taiwan was hit much harder than any other country. eSecurity Planet stresses that only a small share of the attempted intrusions ended in confirmed compromises. HIFY Radar reports that one agent dropped a Honduran air force personnel system as "out of scope." The Acronis summaries quoted in the coverage do not confirm that detail.
Two other recent Taiwanese security incidents are unrelated to this one as far as anyone has reported. The Taipei Times covered a Central Election Commission website that exposed the national ID numbers of 1,573 candidates, which the commission is investigating as a disclosure flaw. It also covered 427 unauthorised transfers at Bank SinoPac, about NT$41.76 million in total, which the bank traced to weak security settings at suppliers of its mobile banking system. Neither Acronis nor any news outlet has linked either incident to BOSSAI, even though banks were among BOSSAI's targets.
What Was Taken
- 119 dispatch records: The agents pulled these case records through the dispatch system's API. They cover seven Taipei districts and include incident times, response types, case status fields and street-level locations. Acronis says plainly that these are case records, not live ambulance tracking. No count of records has been published.
- Fire department patient-care data: A Taipei fire department platform exposed ECG readings, patient vital signs and ambulance video from as far back as 2018 with no login required. Coverage agrees the agents found the platform. The reports do not say how much of that data was actually downloaded.
- Thai university student data: GBHackers and Shell Bulletin report that the agents listed more than 50 subdomains at one Thai university, confirmed a blind SQL injection on an Oracle 9.2.0.4.0 host, and began pulling student records.
- Mexican phone records: GBHackers, citing other reporting, says more than 200,000 Mexican residential phone records were taken. The Acronis material quoted in the coverage does not repeat that figure, so it should be treated as unconfirmed.
Why It Matters
BOSSAI shows one person using AI tools to run a campaign whose size used to point to a team. The operation was also clumsy. eSecurity Planet reports that the agents invented vulnerabilities, failed at many exploitation attempts and missed possible targets. The agents never talked to each other, so the operator had to copy one agent's output into the next by hand.
The models matter too. The Hacker News reports that commercial AI models mostly refused to help with the attacks. HIFY Radar says Grok and MiniMax refused. The attacking agents ran almost entirely on "abliterated" models, meaning models run locally with their safety training removed; HIFY Radar names DeepSeek as the base. GBHackers reports that commercial tools including Grok, OpenClaw, Claude Code and Codex were used as "builders" to maintain the infrastructure. In other words, the safeguards in commercial models pushed the offensive work onto local models but did not keep the operator off commercial AI tools completely.
For defenders, the agents' skill was not the main problem. They mostly found what was already left open: an API returning dispatch data, a patient platform with no login, and an Oracle 9i database still running in production. AI-driven scanning makes those weaknesses cheap to find at scale.
The Attack Technique
Acronis describes 12 agents. Nine were active and three were set up but never used. Coverage names Hermes, Cursor, Trae, CyberStrike and HalberdStrike as attack agents. GBHackers reports that Hermes did most of the offensive work, with about 95 sessions and 18,311 messages. HIFY Radar reports that the operator gave his lead agent full authority and told it to stop asking him for approval.
At its largest, the setup loaded 13 Model Context Protocol (MCP) servers. These gave the agents access to Kali-based tools including nmap, sqlmap and Metasploit, along with Ghidra and a CVE lookup tool. Acronis describes one documented chain against a Taiwanese emergency services target:
- A scanning agent (HalberdStrike, per GBHackers) mapped the target.
- A second agent (Hermes) turned the findings into an attack-path report.
- A third agent (Cursor) ran the exploit on the operator's instruction.
None of the reports names a CVE for the Taipei intrusions. The way they describe it, the dispatch data came from a reachable API and the patient platform had no authentication at all, so this looks like exposure and weak access control rather than a new exploit. HIFY Radar notes that there is no software patch to apply.
What Organizations Should Do
- Inventory and lock down every API on emergency and health systems. Require authentication on every endpoint that returns case, location or patient data, and limit how many records a single query can return.
- Find platforms that serve data without a login. Check legacy patient-care, video and telemetry systems against your external attack surface, especially ones that have stored data for years, like the 2018 archive here.
- Retire or isolate end-of-life databases. An Oracle 9.2 host reachable from the internet with injectable parameters is a target for automated scanning. Take it offline, put a web application firewall in front of it, or move it behind a VPN.
- Tune detection for machine-speed reconnaissance. Fast enumeration of subdomains, nmap and sqlmap fingerprints, and steady automated probing should trigger alerts and blocking, not only log entries.
- Review API and access logs back to early 2026 at least. Emergency services and universities in Taiwan, Thailand and Mexico should look for bulk API pulls and repeated SQL injection probes, and preserve the evidence for CERT reporting.
- Govern your own AI agents. If your teams use MCP servers or coding agents, control which tools they can run, require a human to approve offensive actions, and watch for locally hosted models with no safety training running on company hardware.
Sources: Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency... | AI-Powered BOSSAI Attacks Expose Patient Records and Emergency Disp... | One Hacker Used 12 AI Agents to Target Taiwan's Emergency Services | Secure APIs Against Agentic Attacks That Expose Patient and | Hacker Ran 12 AI Agents and Breached Taipei… HIFY Radar | CEC responds after 1573 candidates data leakage - Taipei Times | No evidence of customer data leak in unauthorized transactions: Sin... | AI attack mesh targeted Taiwan emergency services