BOSSAI: AI-Agent Mesh Operated by Lone Actor Breaches Taiwan Emergency Services, Universities and Banks
Acronis Threat Research Unit (TRU) uncovered BOSSAI, an agentic attack platform built from a mesh of 12 AI agents (nine active) operated by a single individual assessed with high confidence to be based in Hualien City, Taiwan. The campaign targeted hundreds of organizations across eleven countries, including emergency services, banks, universities, military systems and e-commerce platforms, with confirmed breaches at universities and emergency providers exposing medical data and PII. A Taipei fire department patient-care platform leaked ECG readings, ambulance video and patient vitals dating back to 2018 without credentials, alongside case records from the city's 119 dispatch system across seven districts. Reporting also links the campaign to theft of Thai university student data and over 200,000 Mexican residential phone records. TRU classifies the activity as an "AI-augmented threat" — a lone actor with APT-like reach but no clear political or financial motive.
Entenda a falha
A vulnerabilidade
No CVE is assigned. The story is about an AI-agent attack platform (BOSSAI) that exploited old, weak exposures rather than a new flaw. Cited weaknesses: a blind SQL injection on an unpatched Oracle Database 9.2.0.4.0 host at a Thai university, Hikvision cameras exploitable through functions such as keepAlive, applyCT and applyAutoLoginTicket (RCE, per the articles), a Taipei fire department patient-care platform and 119 dispatch API reachable without credentials (a medical-data port open since 2018), and a bank with 16 SQL-injection points. Attackers needed only network reach; they obtained patient data, PII and, on Hikvision, device access. The articles give no affected or fixed versions beyond Oracle 9.2.0.4.0.
Como funciona
The operator's agents scanned a target, for example enumerating more than 50 subdomains of a Thai university. Findings were consolidated by one agent and another ran the exploit on the operator's instruction. On the Oracle host, a blind SQL injection let the attacker infer database content through the application's responses, and student records began to be dumped. On the Taipei systems, requests to the exposed port and public API were simply answered with ECG readings, ambulance video, vitals and case records, because no authentication step stood in the way.
Por que é vulnerável
Acronis says the underlying exposures predated any AI involvement: a medical-data port left open since 2018, dispatch records on an unauthenticated public API, SQL-injection points in a bank's applications and unpatched, outdated Oracle databases. The causes are missing authentication, missing input handling and missing patching. The agents did not create these flaws but found and collected them faster and more systematically than a manual attacker.
Como foi descoberta
Acronis Threat Research Unit found the operation through what looked like a misconfigured development environment holding over 90,000 files (9GB) of agent conversations, command histories and victim data. From it, TRU assessed with high confidence that a single individual in Hualien City, Taiwan operated the infrastructure. The articles do not say how the individual victims were notified.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 06:17.
Detalhes técnicos
Agents named Hermes, Cursor, Trae, CyberStrike and HalberdStrike scanned targets and built exploits, with the mesh at peak loading 13 Model Context Protocol servers exposing tools like nmap, sqlmap, Metasploit (via Kali), Ghidra, and CVE lookup utilities. Builders such as Grok, OpenClaw, Claude Code and Codex maintained infrastructure. Because commercial models refused offensive tasks, the operator used "abliterated" (safety-stripped) open-weight models — DeepSeek, GLM and Qwen variants on local RTX 4090 GPUs — with Hermes cycling through nine models before settling on a DeepSeek-V4 variant called DS4. In one documented chain, HalberdStrike scanned an emergency-services target, Hermes consolidated findings, and Cursor executed the exploit on operator instruction; Hermes alone ran ~95 sessions generating 18,311 messages. The platform also enumerated 50+ subdomains of a Thai university and exploited a blind SQL injection on an unpatched Oracle 9.2.0.4.0 host to dump student records. A C# Windows Forms tool supported full exploitation of Hikvision surveillance cameras via functions like keepAlive, applyCT and applyAutoLoginTicket. Over half of HalberdStrike's high/critical findings were false positives, and some models fabricated CVEs; excessive autonomy also caused agents to skip a Honduran military host judged "out of scope." TRU discovered the operation via a misconfigured development environment containing over 90,000 files (9GB) of agent logs and victim data.
Remediação
Acronis notes the underlying exposures predated AI involvement: a medical-data port open since 2018, unauthenticated dispatch APIs, a bank with 16 SQL-injection points, and unpatched Oracle databases. Defenders should close legacy exposures, authenticate public APIs, patch outdated database systems, and monitor for rapid, automated scanning patterns characteristic of AI-driven reconnaissance.
Linha do tempo
-
BOSSAI: AI-Agent Mesh Operated by Lone Actor Breaches Taiwan Emergency Services, Universities and Banks
ler a análise desta fonte ocultar
Acronis Threat Research Unit (TRU) uncovered BOSSAI, an agentic attack platform built from a mesh of 12 AI agents (nine active) operated by a single individual assessed with high confidence to be based in Hualien City, Taiwan. The campaign targeted hundreds of organizations across eleven countries, including emergency services, banks, universities, military systems and e-commerce platforms, with confirmed breaches at universities and emergency providers exposing medical data and PII. A Taipei fire department patient-care platform leaked ECG readings, ambulance video and patient vitals dating back to 2018 without credentials, alongside case records from the city's 119 dispatch system across seven districts. Reporting also links the campaign to theft of Thai university student data and over 200,000 Mexican residential phone records. TRU classifies the activity as an "AI-augmented threat" — a lone actor with APT-like reach but no clear political or financial motive.
Technical Details
Agents named Hermes, Cursor, Trae, CyberStrike and HalberdStrike scanned targets and built exploits, with the mesh at peak loading 13 Model Context Protocol servers exposing tools like nmap, sqlmap, Metasploit (via Kali), Ghidra, and CVE lookup utilities. Builders such as Grok, OpenClaw, Claude Code and Codex maintained infrastructure. Because commercial models refused offensive tasks, the operator used "abliterated" (safety-stripped) open-weight models — DeepSeek, GLM and Qwen variants on local RTX 4090 GPUs — with Hermes cycling through nine models before settling on a DeepSeek-V4 variant called DS4. In one documented chain, HalberdStrike scanned an emergency-services target, Hermes consolidated findings, and Cursor executed the exploit on operator instruction; Hermes alone ran ~95 sessions generating 18,311 messages. The platform also enumerated 50+ subdomains of a Thai university and exploited a blind SQL injection on an unpatched Oracle 9.2.0.4.0 host to dump student records. A C# Windows Forms tool supported full exploitation of Hikvision surveillance cameras via functions like keepAlive, applyCT and applyAutoLoginTicket. Over half of HalberdStrike's high/critical findings were false positives, and some models fabricated CVEs; excessive autonomy also caused agents to skip a Honduran military host judged "out of scope." TRU discovered the operation via a misconfigured development environment containing over 90,000 files (9GB) of agent logs and victim data.
Remediation
Acronis notes the underlying exposures predated AI involvement: a medical-data port open since 2018, unauthenticated dispatch APIs, a bank with 16 SQL-injection points, and unpatched Oracle databases. Defenders should close legacy exposures, authenticate public APIs, patch outdated database systems, and monitor for rapid, automated scanning patterns characteristic of AI-driven reconnaissance.