A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last week.
The agents also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video footage, without a login.
The researchers are highly confident that the attacker is a single person based in Hualien City, Taiwan. He aimed the agents at hundreds of organizations in at least 11 countries, including emergency services, banks, universities and military systems. The agents collected data or accessed systems at about 10 of them in Taiwan, Mexico and Thailand.
The evidence comes from the attacker's own server, which initially appeared to be a misconfigured development system. It turned out to be his operational attack platform, containing more than 90,000 files, including the agents' conversations, his command history, hacking tools, credentials, and victims' data.
The agents did not communicate with each other, so the attacker manually pasted one agent's output into another. Commercial AI models mostly refused to help him attack. The attacking agents therefore ran almost entirely on "abliterated" models, meaning AI models run locally with their safety training removed.
What the Agents Reached
Taiwan was targeted far more heavily than any other country, according to the researchers' technical analysis. The most serious confirmed harm there involved emergency-services data.
The dispatch records came from a city's system for 119, Taiwan's emergency number for fire and ambulance services. The agents pulled them from the system's API, and they include incident times, response types, case status, and street-level locations. They are case records, not live ambulance tracking.
The researchers' summary says breaches at emergency services and universities led to the theft of medical and personal data. Their detailed account of the Taipei patient platform, however, says only that the records were exposed.
The agents also went after five other targets tied to Taiwan's emergency services:
| Target | What the agents did | Result |
|---|---|---|
| Fire-dispatch technology vendor | Logged into its database admin panel with default root credentials. A web shell attempt through a known CVE failed. | Access to 18 or more database tables |
| Emergency management information system | Found a hardcoded AES-256 key in the site's front-end JavaScript that exposed session-cookie contents, including an administrator's identity | No confirmed compromise |
| National disaster-response center | A scanning tool reported a critical Apache remote code execution flaw | The flaw did not exist |
| National fire agency single sign-on portal | Tried to guess logins (brute force) | No confirmed access |
| Fire-department systems in five cities | Scanned them to identify the software they run | No confirmed compromise |
The report does not say whether the affected organizations or Taiwan's authorities were told, or whether the exposed data can still be reached.
Outside emergency services, the agents pulled data from an account table at a Taiwanese lending firm through SQL injection. In Thailand, they collected data from three universities in the same way, after selecting 489 potential targets across 45 institutions.
In Mexico, they collected about 206,800 home phone records containing names and addresses, using government statistics, postal code lists, and telecom authority data.
About 15 more organizations were attacked without a confirmed break-in. In at least eight other countries, targets were only scanned or lined up for attacks that had not run by the time the researchers looked.
The researchers watched the operation for 12 days. One recorded exchange shows the attacker at work on July 25.
How the AI Was Used and Where It Failed
The setup, called BOSSAI, had 12 AI agents, with 9 in use. Some built and maintained the attacker's servers and tools, while others scanned targets and carried out attacks.
Commercial cloud models did most of the building, with Grok as the main builder. When the attacker directly asked them to attack, Grok and MiniMax M3 refused and requested written proof that the work was authorized. The researchers say it is unclear whether a fake authorization letter would have changed that.
Grok made one exception, repairing a broken proof-of-concept script that the attacker then handed to an attack agent. The attacker also redirected the coding agents Claude Code and Codex to an abliterated model, though they mostly did infrastructure work. Cursor, another coding agent, attacked a Taiwanese emergency-services site while running such a model.
The abliterated models were versions of DeepSeek, GLM, and Qwen.
The agents also got things wrong. One scanning tool invented CVEs, and more than half of its high and critical findings were false positives or wrongly classified. The main attack agent also reported results that had not happened.
Who Ran It
Acronis's attribution rests on mistakes the attacker made while hiding his identity, combined with publicly available information. He reused a single identity across his legitimate businesses and his attack servers, including a GitHub profile, a logo, an SSH key name, and an email address.
His home IP address appeared during an SSH session in one of his Grok conversations.
Why he did it is less clear. Some attacks on government, emergency, and military targets looked like the work of state-backed hacking groups, while others looked like ordinary cybercrime. The researchers think he probably wanted to make money, and it is unclear whether he works for anyone.
What Stopped the Agents
What the agents found was mostly data that was already poorly protected, according to the researchers: a medical data port left open since 2018, dispatch records on a public-facing API, a lender with 16 SQL injection points, and universities running unpatched Oracle databases.
The agents failed where logins were enforced, where paywalls required a valid session, and where endpoints were properly filtered. The AI made it cheap to find and reach many targets at once, but it did not get past defenses that held.
Nine IP addresses and nine domains from the attacker's setup appear in the indicator list at the end of the analysis. None is marked as active or inactive, and most come without a note on what they were used for.
