A single operator in Taiwan built a team of 12 AI agents and used it to attack hundreds of organisations in 11 countries, according to cybersecurity firm Acronis. The campaign, which Acronis calls BOSSAI, hit emergency services, universities and public-sector systems — and led to confirmed theft of medical data and personal records.

Acronis Threat Research Unit published the investigation on 4 November after finding what first looked like a misconfigured development server. It turned out to be the operator's own attack platform, holding more than 90,000 files and about 9GB of logs, chat histories, exploit tools and victim data. Acronis assesses "with high confidence" that one person in Hualien City, Taiwan, ran the whole operation.

How the 12-agent mesh worked

The mesh had 12 agents, but only nine were active. Builder agents such as Grok, OpenClaw, Claude Code and Codex set up servers, DNS and proxies, while attack agents such as Hermes, Cursor, Trae and CyberStrike scanned targets and wrote exploits. The agents were linked to security tools through MCP servers, including HexStrike AI, a Kali Linux server and a Ghidra bridge, and used tools including nmap, sqlmap, Metasploit and Ghidra.

The agents did not talk to each other. The operator copied output from one tool and pasted it into the next by hand — in one documented chain, a scanner checked a Taiwanese emergency-services site, the operator pasted the report into Hermes for attack-path analysis, then pasted that into Cursor with instructions to exploit the vulnerabilities.

Commercial models refused the offensive requests, so the attack agents moved onto abliterated open-weight models, mainly DeepSeek, GLM and Qwen variants, with an abliterated DeepSeek-V4 build called DS4 as the final default. The operator issued commands in Traditional Chinese, often no more than a victim address.

Emergency services hit hardest

The worst confirmed harm hit emergency services in Taiwan. A Taipei fire-department patient-care platform exposed ECG readings, ambulance video and patient vital signs with no login required — records dating to 2018, but readable by anyone. A city 119 dispatch system gave up case records with incident times, response types and street-level locations across seven Taipei districts. A fire-dispatch technology vendor's database admin panel was logged into with default root credentials, exposing 18 or more tables.

Acronis counts about 10 confirmed breaches across three countries, about 15 further targets attacked without confirmed compromise, and reconnaissance or staging against entities in eight more countries. Targets included emergency services, universities, banks, e-commerce platforms and gambling sites, as well as corporate and government-adjacent systems in China and Vietnam.

AI-augmented threat — but sloppy

Acronis calls this kind of actor an "AI-augmented threat", because the activity looks like a state-backed group but comes from one person with rented GPUs and open-source tools. Taiwan's Ministry of Digital Affairs reportedly detected AI-assisted attacks on government agencies from 20 July 2026 and set up a task force.

The campaign was also strikingly sloppy. More than half of the scanning layer's high-severity and critical findings were false positives or misclassifications, Acronis reports — at one national disaster-response centre the agent reported a critical Apache remote code execution flaw that did not exist. And the whole operation was exposed because the operator left 9GB of his own logs on an open server. No arrest has been mentioned in the report. The lesson for defenders is blunt: a lone operator with AI agents can now run a campaign that once needed a full team — but the same automation that scales the attack also scales its mistakes.