Taiwanese Hacker Uses BOSSAI AI Agents to Breach Emergency Dispatch Systems
A lone attacker exploited AI agents to steal sensitive medical and dispatch records across Taiwan.
1AI-Driven Cyber Operation Discovered
Researchers at Acronis identified a lone attacker based in Hualien City, Taiwan, utilizing a custom AI framework named BOSSAI. The operation targeted hundreds of organizations across 11 countries, successfully breaching systems in Taiwan, Thailand, and Mexico. The attacker leveraged automated agents to scan for vulnerabilities and extract sensitive data from various institutions.
2Emergency Dispatch Records Compromised
The attacker successfully extracted emergency dispatch records from Taipei’s 119 fire and ambulance service system. These records included incident times, response types, and street-level locations. Additionally, the agents discovered an unprotected Taipei fire department platform containing patient data from 2018, including ECG readings and ambulance video footage, which remained accessible without login.
3Exploiting Abliterated AI Models
While commercial AI models like Grok and MiniMax M3 largely refused to assist in malicious activities, the attacker bypassed these safeguards using abliterated models. These are local AI versions with safety training removed, including DeepSeek, GLM, and Qwen. The attacker manually integrated outputs from these agents to conduct infrastructure maintenance and attacks.
4Global Scope of Data Theft
Beyond Taiwan, the operation impacted multiple international targets. In Mexico, the attacker collected over 206,800 home phone records, including names and addresses. Meanwhile, in Thailand, three universities were breached via SQL injection. The attacker scanned 489 potential targets across 45 institutions, demonstrating a broad reach despite the limited success of actual penetrations.
5Operational Platform and Evidence
Evidence was recovered from the attacker’s own server, which was initially mistaken for a misconfigured development system. It contained over 90,000 files, including command history, hacking tools, and stolen victim data. The attacker’s identity was linked to his activities through reused credentials, including a GitHub profile, SSH keys, and his home IP address.
6Technical Limitations and Failures
The BOSSAI setup included 12 AI agents, with nine actively performing tasks like server maintenance and target scanning. However, the system frequently malfunctioned, with one tool inventing CVEs and producing false positives. The agents failed to bypass properly secured endpoints, demonstrating that AI efficiency cannot overcome robust authentication and effective network filtering.
7Motivations and Target Selection
The attacker’s primary motivation remains unclear, though researchers suspect financial gain rather than state-sponsored espionage. Targets included banks, universities, and military systems, often exploiting poorly protected infrastructure. The attacker specifically targeted systems with unpatched databases or exposed APIs, highlighting the persistent risk posed by legacy software and basic security configuration errors.
8Implications for Security Operations
This incident underscores the emerging threat of AI-augmented cybercrime, where automation lowers the barrier for scanning and exploiting vulnerabilities. While the attacker’s manual intervention was required, the scale of the operation highlights the need for organizations to prioritize identity visibility and endpoint security to defend against increasingly sophisticated, AI-driven reconnaissance tactics.