Researchers at Acronis Threat Research Unit (TRU) have uncovered an AI-assisted cyberattack operation, named BOSSAI, in which a single operator used a network of artificial intelligence agents to target hundreds of organisations across at least 11 countries. Published on 4 November 2026, the investigation describes how the operation targeted government emergency services, financial institutions, universities, military-related systems and other organisations. During a 12-day investigation, researchers examined the operator’s attack infrastructure and recovered more than 90,000 files containing approximately 9GB of data, including AI conversations, command histories, hacking tools, credentials and information collected from targeted systems. Acronis assessed with high confidence that the operation was managed by one individual based in Taiwan, although the research did not establish whether the operator was working independently or on behalf of another party. The researchers identified confirmed system access or data extraction at approximately 10 targets across Taiwan, Mexico and Thailand, while around 15 additional organisations were attacked without confirmed compromise. Other targets in several countries were only scanned or prepared for possible attacks.
Taiwan experienced the most extensive activity, with emergency services among the most significant targets. According to Acronis, the AI agents accessed a city’s 119 emergency dispatch system and extracted case records covering seven Taipei districts. The information included incident times, response types, case status and street-level locations, but did not contain live GPS tracking of ambulances. Researchers also identified a Taipei fire-department patient-care platform that exposed medical records dating back to 2018, including electrocardiogram readings, ambulance video footage and patient vital signs, without requiring authentication. However, the report distinguishes between the dispatch records that were extracted and the medical information that was found exposed, without confirming that the latter was also downloaded. Other attempts against Taiwanese emergency-service systems produced mixed results. The agents accessed a fire-dispatch technology vendor’s database administration panel using default root credentials, exposing at least 18 database tables, while an attempted web-shell deployment failed. They also identified a hardcoded encryption key in the front-end code of an emergency management information system that could expose session-cookie contents, although full system compromise was not confirmed. Attempts to access a national fire agency’s single sign-on portal through password guessing did not result in confirmed access, and scans of fire-department systems across five cities did not establish further compromises. Outside emergency services, the operation successfully extracted account information from a Taiwanese lending firm through SQL injection and demonstrated a payment-card validation weakness at a mobile payment provider.
The investigation also documented activity in Mexico and Thailand. In Mexico, the operator used automated collection methods to assemble approximately 206,800 residential telephone records containing names, addresses and postal codes, drawing on government statistical information, postal-code registries and telecommunications data. A separate collection effort gathered around 124,000 records from an online directory. In Thailand, the agents identified 489 potential targets across 45 universities and conducted automated SQL injection testing against selected systems. Acronis confirmed data extraction from three universities, including the collection of database tables and student information, while two other institutions had confirmed injection points without confirmed data extraction. The wider operation involved a 12-agent setup, with nine agents active during the investigation. These agents handled different responsibilities, including infrastructure management, vulnerability scanning, reconnaissance and attempted exploitation. They did not communicate directly with one another; instead, the operator manually transferred information between their sessions. Commercial AI models were primarily used to build and maintain the infrastructure, while models with their safety restrictions removed, described as abliterated models, handled much of the offensive activity. The attack agents mainly used modified versions of DeepSeek, GLM and Qwen. Acronis also found that commercial models such as Grok and MiniMax M3 refused direct requests to conduct attacks, although one model helped repair a proof-of-concept script that was subsequently used by an attack agent.
The research highlights both the potential reach and limitations of AI-assisted cyberattacks. Although the agents automated reconnaissance, vulnerability assessment and parts of the exploitation process, they also produced inaccurate results. Acronis found that more than half of the high and critical findings generated by one scanning platform were false positives or incorrectly classified results, while other agents also reported actions that had not actually succeeded. The investigation suggests that the most significant compromises relied on weaknesses that already existed in the targeted environments, including exposed medical information, publicly accessible emergency-service APIs, default credentials and unpatched database systems. The agents were less successful against systems with effective authentication controls, properly filtered endpoints and other security restrictions. Acronis did not establish a confirmed political or state-backed affiliation for the operator, noting that the activity included both potential espionage-related targets and operations resembling financially motivated cybercrime. The report therefore presents BOSSAI as an example of how one individual can use multiple AI agents to expand the scale of cyber operations, while also demonstrating that automation does not eliminate the need for exploitable weaknesses in target systems.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
