Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records

The attackers' own server, initially appearing to be a misconfigured development system, was actually his operational attack platform, containing more than 90,000 files, including the agents' conversations, his command history, hacking tools, credentials, and victims' data.

The setup, called BOSSAI, had 12 AI agents, with 9 in use. Some built and maintained the attacker's servers and tools, while others scanned targets and carried out attacks.

Commercial cloud models did most of the building, with Grok as the main builder. When the attacker directly asked them to attack, Grok and MiniMax M3 refused and requested written proof that the work was authorized.

The researchers say it is unclear whether a fake authorization letter would have changed that. Grok made one exception, repairing a broken proof-of-concept script that the attacker then handed to an attack agent.

The attacker also redirected the coding agents Claude Code and Codex to an abliterated model, though they mostly did infrastructure work. Cursor, another coding agent, attacked a Taiwanese emergency-services site while running such a model.

The abliterated models were versions of DeepSeek, GLM, and Qwen. The agents did not communicate with each other, so the attacker manually pasted one agent's output into another.

The researchers watched the operation for 12 days. One recorded exchange shows the attacker at work on July 25.

Targets and Data Stolen

Taiwan was targeted far more heavily than any other country, according to the researchers' technical analysis. The most serious confirmed harm there involved emergency-services data.

The dispatch records came from a city's system for 119, Taiwan's emergency number for fire and ambulance services. The agents pulled them from the system's API, and they include incident times, response types, case status, and street-level locations.

The agents also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video footage, without a login.

The agents also went after five other targets tied to Taiwan's emergency services:

• A Taiwanese lending firm
• Three universities in Thailand
• About 206,800 home phone records containing names and addresses in Mexico

The researchers' summary says breaches at emergency services and universities led to the theft of medical and personal data. Their detailed account of the Taipei patient platform, however, says only that the records were exposed.

The report does not say whether the affected organizations or Taiwan's authorities were told, or whether the exposed data can still be reached.

Method and Attribution

The agents also got things wrong. One scanning tool invented CVEs, and more than half of its high and critical findings were false positives or wrongly classified. The main attack agent also reported results that had not happened.

Acronis's attribution rests on mistakes the attacker made while hiding his identity, combined with publicly available information. He reused a single identity across his legitimate businesses and his attack servers, including a GitHub profile, a logo, an SSH key name, and an email address.

His home IP address appeared during an SSH session in one of his Grok conversations.

The researchers are highly confident that the attacker is a single person based in Hualien City, Taiwan. He aimed the agents at hundreds of organizations in at least 11 countries, including emergency services, banks, universities and military systems.

The agents collected data or accessed systems at about 10 of them in Taiwan, Mexico and Thailand.

About 15 more organizations were attacked without a confirmed break-in. In at least eight other countries, targets were only scanned or lined up for attacks that had not run by the time the researchers looked.

Why It Worked and What Stopped It

What the agents found was mostly data that was already poorly protected, according to the researchers: a medical data port left open since 2018, dispatch records on a public-facing API, a lender with 16 SQL injection points, and universities running unpatched Oracle databases.

The agents failed where logins were enforced, where paywalls required a valid session, and where endpoints were properly filtered. The AI made it cheap to find and reach many targets at once, but it did not get past defenses that held.

The researchers think he probably wanted to make money, and it is unclear whether he works for anyone. Some attacks on government, emergency, and military targets looked like the work of state-backed hacking groups, while others looked like ordinary cybercrime.

Why he did it is less clear.

Nine IP addresses and nine domains from the attacker's setup appear in the indicator list at the end of the analysis. None is marked as active or inactive, and most come without a note on what they were used for.