One operator ran a 12-agent AI attack mesh that hit Taiwan's emergency services and targets in 11 countries

One person in Taiwan ran twelve AI agents like a team, and emergency-services data was among what they took.

What happened

Acronis Threat Research Unit found what looked like a misconfigured development server and opened a full attack platform: more than 90,000 files and about 9GB of logs, chats, tools and victim data. Inside was BOSSAI, a mesh of 12 AI agents (nine active). Builders handled servers, DNS and proxies; attack agents scanned and exploited. The operator sat in the middle, pasting output from one into the next. Commercial models refused to hack and lectured him on cyber law, so the offensive core ran on locally hosted abliterated models with safety stripped out, often in full auto-approve mode.

The damage

In Taiwan, agents reached a Taipei fire-department patient-care platform that exposed 2018 ECGs, ambulance video and vital signs with no login, and pulled 119 dispatch case records across seven Taipei districts. Elsewhere Acronis confirmed theft at universities and lenders: about 206,800 Mexican residential phone records collected, 489 Thai university targets scored with extraction at three, and a Taiwanese lender hit through 16 SQL injection points. Roughly ten targets across three countries saw confirmed access or exfiltration in the 12 days observed.

How it was caught, and what happened next

Acronis attributes the mesh with high confidence to a single operator in Hualien City and published indicators of compromise. Commercial-model refusals slowed the attacker but did not stop him once abliterated locals took over. Over half of one scanner's high-severity findings were false positives.