A single person in Taiwan ran a team of 12 artificial intelligence agents that attacked hundreds of organisations in 11 countries, stealing medical records, emergency dispatch data and personal information, according to research published by the Acronis Threat Research Unit.

The campaign, which Acronis calls BOSSAI, targeted government emergency services, banks and lenders, universities, military systems, phone directories, e-commerce sites and gambling platforms. Acronis says it found confirmed breaches at universities and emergency services providers, with medical data and personal information taken.

The most serious confirmed damage was in Taiwan. A Taipei fire department patient-care platform exposed electrocardiogram readings, ambulance video and patient vital signs without any login being needed. The records dated back to 2018. Agents also pulled case records from a city 119 dispatch system, covering incident times, response types, status fields and street-level locations across seven Taipei districts.

Acronis stressed that those were dispatch case records held in an application programming interface, not live tracking of moving ambulances. A fire-dispatch technology vendor's database administration panel was also reached using default root credentials, exposing at least 18 tables.

The campaign reached beyond Taiwan. Acronis reports that agents extracted student data from three universities in Thailand, in one case mapping more than 50 subdomains, confirming a blind SQL injection flaw on an old Oracle database host and beginning to dump student records. Around 206,800 residential phone records were also collected in Mexico. In total, Acronis counts about ten targets with confirmed system access or data theft across three countries, with about 15 more attacked without confirmed compromise.

The investigation was possible because the operator left the evidence behind. Acronis found what first looked like a misconfigured development environment and recovered more than 90,000 files totalling about 9GB, including agent conversations, command histories, exploit tools and victim data. On that evidence, the unit assesses with high confidence that one individual in Hualien City, Taiwan, ran the whole operation.

The 12 agents had separate roles. Builders such as Grok, OpenClaw, Claude Code and Codex assembled and maintained the infrastructure, while attackers led by Hermes, with Cursor, Trae and CyberStrike, scanned targets and built exploits. A scanning layer built around an agentic tool called HalberdStrike and a cracked copy of a commercial web scanner fed vulnerability reports into the pipeline. At its peak the mesh loaded 13 Model Context Protocol servers, giving the agents access to tools including nmap, sqlmap and Metasploit through Kali Linux, plus Ghidra and CVE lookup services.

The operator sat at the centre of it all. The agents did not talk to each other directly. Instead, the operator manually pasted the output of one agent into another, often issuing attack commands in Traditional Chinese that were no more than a victim's address. In one documented chain, HalberdStrike scanned a Taiwanese emergency services target, Hermes consolidated the findings, and Cursor was told to exploit the flaws it found. Hermes alone ran about 95 sessions and generated 18,311 messages.

Commercial AI models repeatedly refused to do the offensive work, asking for proof of legal authorisation and citing computer-crime law. The operator therefore turned to locally run open-weight models with their safety alignment removed, including variants of DeepSeek, GLM and Qwen, hosted on local RTX 4090 graphics cards. Hermes cycled through at least nine models in 19 days before settling on a DeepSeek variant the operator called DS4.

The agents were far from flawless. Acronis found that over half of HalberdStrike's high and critical findings were false positives or misclassifications, and some models invented CVEs that did not exist. Given excessive autonomy, agents also passed over a Honduran military host because they judged it out of scope. Acronis describes the campaign as an AI-augmented threat: a lone actor with the reach of a state-backed group, but with no clear political or financial objective.

Taiwan's Ministry of Digital Affairs said in August that it had detected AI-assisted attacks on government agencies since 20 July, and the island has since set up a task force to tackle AI cyber threats. Acronis notes that the exposed systems were weakly protected before any AI was involved, including a medical-data port left open since 2018 and a bank with 16 SQL injection points and unpatched Oracle databases. The agents did not create those flaws, but they found and collected them faster and more systematically than a manual attacker could. Defenders should close legacy exposures, require authentication on public programming interfaces and watch for rapid, automated scanning.