It's the second case in a few weeks where AI agents did much of the work in a real attack, after ARTEX. The difference is that there's no group behind this one: there's one person.

◢What BOSSAI is

BOSSAI is the name the attacker gave the agent network. According to Acronis¹, nine of the twelve were active and each had a role: some built and maintained the infrastructure, some looked for vulnerabilities and some attacked. They were connected to well-known hacking tools such as nmap, sqlmap and Metasploit through MCP servers, the standard agents use to drive outside programs.

The agents didn't talk to each other. The attacker was the bridge, copying one agent's report and pasting it into another with orders like "help me exploit the vulnerabilities". Two of them were driven from a phone, one through WeChat and one through LINE. The main agent was told to make every decision on its own and report back only when a vulnerability was confirmed exploitable.

The researchers got access to more than 90,000 files, 9 GB in all, with attack logs, agent conversations, command histories and stolen data. That's why this case can be told in such detail.

◢What it achieved

Taiwan was the main target. According to Acronis¹:

• ▹The agents got into a city's 119 dispatch system, the number for fire and ambulance services, and pulled records from seven Taipei districts with times, response types and street-level locations.
• ▹They found a Taipei fire department platform exposing patient medical data from 2018 without a password: ECG readings, ambulance video and vital signs.
• ▹At a lending company they confirmed 16 SQL injection points and extracted data from an accounts table.
• ▹They logged into a fire-dispatch software vendor's database panel with the root user and the default password.
• ▹In Thailand they extracted data from three universities, and in Mexico they compiled about 206,800 residential phone records with names and addresses.

In all, Acronis confirms data theft or system access at about 10 targets in three countries, and unsuccessful attacks on about 15 more.

◢What didn't go to plan

This is the most useful part for defenders. Commercial models refused to attack again and again. According to Acronis¹, several asked for proof that the attack was legal and, without it, wouldn't help, and one even reminded the attacker which laws were being broken. So the attacker had to use open models with their safeguards stripped out, running on their own graphics cards. Those models are weaker, and it showed.

The agents also made mistakes. A scanning platform reported a critical flaw at a national disaster-response center that didn't exist. More than half of its serious findings were false positives. And because they had orders not to bother the operator, one agent passed over a Honduran military system because it decided on its own that it was out of scope.

A curious detail: the attacker used coding tools such as Claude Code and Codex to build part of the infrastructure, but, according to Acronis, rerouted their calls so they were answered not by Anthropic's or OpenAI's models but by the same unrestricted model used for the attacks.

◢What we don't know

Acronis sells cybersecurity products, so it's worth reading the report with that in mind, although the evidence it publishes is very specific.

◢The takeaway

The conclusion from Acronis¹ that matters most for a regular company is this: the agents failed where authentication was properly enforced, where a valid session was required and where ports were filtered. What they achieved was in places that were already weak: a port with medical data open since 2018, a public API, a database with a default password, SQL injections in production.

AI hasn't invented new ways in. What has changed is that a single person can now check hundreds of targets at once and find the one with the door open. Hiding no longer works: if your website has a classic flaw, someone will find it.

1. ▹Take stock of what you have exposed to the internet, including anything a vendor set up.
2. ▹Change every default password and turn on two-factor authentication wherever you can.
3. ▹Update or retire old applications. An SQL injection in an old website is still the easiest way in.
4. ▹Take off the internet anything that doesn't need to be there, such as database panels or internal services.

If you use AI agents in your company, this case also shows what happens when you give them full autonomy without supervision: they create noise, make mistakes and take decisions nobody reviews. I wrote about it in AI agents with too many permissions. And if you want your team to know how to protect itself from these attacks and use AI with good judgment, that's part of what I cover in my cybersecurity and AI training.