Overview
Researchers at Acronis’s Threat Research Unit have documented one of the most operationally detailed real-world deployments of offensive AI agents to date. A single attacker based in Hualien City, Taiwan used a framework dubbed BOSSAI to orchestrate AI agents against hundreds of organisations across at least 11 countries. The campaign successfully compromised or accessed systems at approximately 10 targets in Taiwan, Mexico, and Thailand, with Taiwan’s emergency-services ecosystem bearing the most significant confirmed harm.
The attacker exfiltrated emergency dispatch records from Taipei’s 119 system — covering incident times, response types, case status, and street-level locations across seven districts — and discovered an unauthenticated Taipei fire department platform exposing patient ECG readings and ambulance video footage from 2018.
Technical Analysis
The attacker’s operational platform was exposed through a misconfigured server containing over 90,000 files, including agent conversation logs, command history, hacking tools, harvested credentials, and victim data. This provided researchers with rare insight into agentic attack methodology in the wild.
Key technical findings:
- Safety-stripped models: Commercial AI models refused to assist with offensive tasks. The attacker bypassed this entirely by running locally-hosted “abliterated” models — open-weight LLMs with safety alignment training removed — giving agents unconstrained tool use.
- Manual agent chaining: The agents did not communicate autonomously. The attacker manually passed output from one agent into the next, acting as a human-in-the-loop orchestrator.
- Credential exploitation: Agents logged into a fire-dispatch technology vendor’s database admin panel using default root credentials, gaining access to 18 or more database tables.
- Hardcoded key discovery: A hardcoded AES-256 key was found embedded in front-end JavaScript of an emergency management information system, exposing session-cookie contents including an administrator’s identity.
- API data pull: Dispatch records were extracted directly from the city’s 119 system API — no vulnerability was required; access controls were simply absent or insufficient.
- False positive exploitation attempt: Agents acted on a scanner report of a critical Apache RCE flaw against a national disaster-response centre; the flaw did not exist, illustrating the risk of agent over-reliance on automated scanner output.
Framework Mapping
- AML.T0103 (Deploy AI Agent): Core attack primitive — agents were deployed for reconnaissance, exploitation, and data collection.
- AML.T0086 (Exfiltration via AI Agent Tool Invocation): Dispatch records and database contents extracted through agent-driven API and panel access.
- AML.T0054 (LLM Jailbreak): Abliteration of model safety training is a structural jailbreak applied at the model level rather than via prompt.
- LLM08 (Excessive Agency): Agents were granted broad tool access enabling credential use, database querying, and web shell attempts without human confirmation per action.
- LLM06 (Sensitive Information Disclosure): Patient records, ECG data, dispatch logs, and administrator session tokens were all exposed or extracted.
Impact Assessment
The confirmed harm is significant: emergency dispatch records for seven Taipei districts and unauthenticated access to patient medical data represent direct risks to individual privacy and, if live tracking were involved, operational security of emergency response. The breadth of targeting — banks, universities, military systems across 11 countries — signals this methodology is being stress-tested at scale.
Mitigation & Recommendations
- Eliminate default credentials on all database admin panels and internet-facing management interfaces.
- Remove cryptographic keys and tokens from client-side JavaScript — use server-side session management.
- Restrict API access to authenticated and authorised consumers only; apply rate limiting to detect agent-driven enumeration.
- Monitor for abliterated model artefacts in threat intelligence feeds; treat locally-run uncensored LLMs as a red-team and adversary tool category.
- Implement anomaly detection for high-volume, structured API queries consistent with automated agent reconnaissance.
References
- Original article — The Hacker News
- Acronis Threat Research Unit technical analysis (referenced in article)