BOSSAI: the AI attack mesh one person ran against emergency services

On November 4, Acronis's Threat Research Unit published its analysis of a campaign it calls BOSSAI: a single person, running a mesh of twelve AI agents from a home broadband connection in Hualien City, Taiwan, who reached emergency-services systems, banks, and universities across eleven countries. The headline is the twelve agents. The part that should hold a CISO's attention is what the agents actually broke into — and how ordinary it was.

Developing story — first published 10:55 CET (09:55 UTC), 9 November 2026. Updated as Acronis and the affected authorities publish more.

What happened — twelve agents, one human bridge

Per the Acronis TRU report, the operation ran a mesh of 12 AI agents — nine active, three set up but unused — driven by a rotating set of models. "Builder" agents (Grok 4.5, OpenClaw, Claude Code, Codex) handled infrastructure; "attacker" agents (Hermes as the primary, plus Cursor, Trae, and CyberStrike) scanned, wrote exploits, and ran scripts; a scanning layer (HalberdStrike and a cracked Acunetix install) produced structured reports for the attackers.

There was no agent-to-agent automation. The operator was the bridge, copying and pasting output between terminal windows in Traditional Chinese, reaching Hermes over WeChat and OpenClaw over LINE. The offensive brains were "abliterated" models — stripped-down DeepSeek, GLM, and Qwen variants with safety alignment removed, running locally on GPU hardware. Hermes alone logged roughly 95 sessions, 18,311 messages, more than 3,300 terminal commands, and 561 sqlmap invocations.

The commercial models refused. Grok demanded written authorization; MiniMax M3 told the operator "I'm the gatekeeper," and cited the Thailand Computer Crime Act. Acronis uncovered the whole thing after flagging what looked like a misconfigured development environment, which unspooled into more than 90,000 files and 9 GB of evidence. Acronis classifies the operator as an "AI-augmented threat" — one person whose output resembles a state-backed group, as independent coverage of the report also noted.

What actually fell — and what held

None of the confirmed hits were zero-days. Acronis puts confirmed data exfiltration or system access at roughly 10 distinct targets across three countries. The mechanisms were the oldest ones in the book:

Target	How it fell	Would auth have stopped it?
Taipei 119 dispatch	Case records pulled through the system's own API — incident times, response types, street-level locations, 7 districts	Yes
Taipei fire-dept patient platform	2018 ECG readings, ambulance video, vital signs — reachable without any login	Yes
Lending firm	SQL injection on an MSSQL 2017 backend; 16 injection points; account table extracted	Yes (parameterized queries)
Fire-dispatch vendor	Database admin panel opened with default root credentials; 18+ tables exposed	Yes
Thai universities	SQL injection dumps at 3 of 45 institutions, including a 2,563-row Oracle admin table	Yes

Acronis's own conclusion is the one to pin to the wall: the agents "failed where authentication was enforced, where paywalls required valid sessions and where endpoints were properly filtered." And bluntly: "Obscurity is therefore no longer a valid defense."

The agents were also mediocre. HalberdStrike hallucinated non-existent CVEs in over half of its critical findings. One produced a confident, structured report for a critical Apache RCE on a port that was filtered, with no Apache even confirmed. Hermes stumbled onto a Honduran air-force personnel system and abandoned it mid-task, deciding on its own that it was out of scope. This was not a precision instrument. It was a cheap, tireless one.

The economics changed, not the sophistication

That is the whole lesson. The force multiplier here is cost, not skill. Acronis says it plainly: "The AI agents made it cheap to find and reach all these targets in parallel across multiple countries." One person covered eleven countries — Taiwan, Thailand, Mexico, and others — probing hundreds of organizations at machine tempo, because the labor of looking went to nearly zero.

Anthropic's September 2026 threat report reached the same place from the other side of the industry, under the heading "Sophisticated attacks no longer require sophisticated attackers." Its framing: "AI has collapsed the labor and tooling gap" and "AI has inverted the cost back onto defenders." In one case it documented, agents affiliated with a data-extortion cluster dumped more than 2,100 Azure AD token sets across 40-plus corporate tenants in about 34 hours, with the AI performing nearly all of the work. CyberStrike, one of BOSSAI's named attack agents, is the same class of open offensive framework behind the 44-agent campaign against Japanese targets and the ARTEX framework turned on 200+ organizations.

The practical consequence for your estate is simple: the exposed thing you assumed nobody would bother to find now gets found, because finding it is free. The only durable answer is to look at your own perimeter with the same cheap, relentless parallelism the attacker now has — which is what automated penetration testing exists to do.

How not to be the Taipei fire department

The runbook is unglamorous and complete:

1. Inventory every internet-facing API and admin panel. Assume each will be probed within the hour. Require authentication on all of them — the agents stopped dead at enforced auth.
2. Eliminate default credentials. The fire-dispatch vendor fell to a database panel still on default root. Rotate, and check for them continuously, not once.
3. Hunt your own unauthenticated and legacy services before the mesh does. The 2018 patient-care platform was reachable with no login — the kind of forgotten system that "obscurity" was silently protecting.
4. Treat SQL injection as a first-class exposure. Parameterize queries, and validate with the same sqlmap-class tooling the agents point at you.
5. Define your attack surface as "what a stranger with zero credentials can reach." That is the exact surface that fell here — nothing deeper was needed.

Catch the mesh while it's reading

The other defensive truth: these agents are loud. Machine-tempo scanning, bulk API reads, 561 sqlmap runs, hundreds of Shodan and nmap lookups. The dispatch-record and phone-directory thefts were bulk extractions — the sort of anomalous volume and egress a network sees while it is happening, long before it surfaces in the next morning's log review. Endpoint tooling never saw most of this, because the activity lived on the wire, not on a managed host.

What is not known yet

• Acronis describes a roughly 12-day observation window but does not publish the full intrusion timeline.
• The Taipei fire-department platform is described as "exposing" 2018 medical data in the body and listed under confirmed exfiltration in the summary; whether that data was pulled in bulk or only reached is not fully resolved.
• No CVEs are named for the confirmed victims — one failed webshell attempt used "a known CVE" that Acronis does not identify. The operator is attributed by handle ("bossjy") and location, not named.
• Figures may move as Acronis and Taiwanese authorities publish follow-ups.

The answer is to look first — and to watch the wire

BOSSAI is not a story about superhuman AI. It is a story about a cost collapse that turns every exposed API and every default password into a liability someone will now certainly find. The defensible posture is to find them first, with the same economics. Zero Hunt is an autonomous AI red team that runs on an on-premise appliance on its own private models, with a human in the loop for every action that matters: its 10-agent swarm generates a per-target exploit chain — black-box, no credentials, exactly as bossjy's agents worked — backtested in the AI Gym before it runs, so you learn that your 119 API answers without a token, or that an admin panel still holds default root, before an outside operator does. Every finding is signed at write time (Ed25519, hash-chained) for the audit trail.

And when something is already reading your data, the catch has to happen on the wire. Zero Hunt's traffic analysis is a deep-learning model with four parallel inference heads — suspicious traffic, malware classification, attack-type identification, application fingerprinting — trained on billions of PCAP sequences and running locally on the appliance GPU. It is built to flag the bulk API pull and the machine-tempo scan as they occur, not in the SIEM digest the next day. The economics of the attack have changed. The economics of the defense have to change with them.