One person, twelve AI agents, hundreds of targets in eleven countries. That was BOSSAI, an attack operation uncovered by the Acronis Threat Research Unit (TRU) and written up on the Acronis blog on 8 November 2026. TRU first published the findings on 4 November.
What TRU found
The operator, based in Taiwan, ran 12 AI agents with separate jobs: maintaining infrastructure, scanning for vulnerabilities and attempting exploitation. Nine were active when researchers examined the environment. Confirmed breaches at universities and emergency services providers led to theft of medical records and personally identifiable information, including at an emergency services target in Taiwan.
TRU found the operation through what first looked like a misconfigured development environment. It went on to examine more than 90,000 files, about 9GB of evidence covering agent conversations, commands, tools and victim data.
The agents did not talk to each other. The operator copied findings from one interface into another by hand. In one documented sequence, a scanning agent produced findings, a second assembled an attack-path report and a third was told to exploit the weaknesses.
What did not work
For defenders, this part of the research is probably the more useful one.
- Commercial AI models repeatedly refused requests to identify and exploit vulnerabilities, sometimes asking the operator to prove authorisation.
- So the operator turned to locally hosted models with safety restrictions removed. These were less capable. TRU saw fabricated vulnerability findings, failed processes logged as discoveries and floods of output that made decisions harder.
- One agent came across a Honduran military system and dropped it because it judged the target outside its assigned scope.
Commercial models were still useful to the operator, just not for the attack itself. They helped build and maintain the surrounding infrastructure.
Why this matters
TRU calls this an AI-augmented threat actor: one individual whose activity looks like a larger, better-funded group. Most attackers are not running autonomous AI armies. What this case shows is that ordinary weaknesses (exposed services, unpatched vulnerabilities, poorly protected records) can now be worked through in repeatable, scaled-up workflows.
Two things follow. The basics matter more now: visibility of exposed services, fast remediation, and monitoring for unusual access and data movement. And you can't judge the risk of an agentic operation by looking at one model. The danger sits in the tools, permissions, operator decisions and handoffs that stitch individual outputs into a campaign. Model guardrails did slow this attacker down. They did not stop the breaches.
Source: AI attack mesh targeted Taiwan emergency services (Acronis)
