Acronis researchers uncover AI attack mesh targeting emergency services

A single attacker used a network of specialized AI agents to target hundreds of organizations across 11 countries, including emergency services in Taiwan, according to a new investigation by the Acronis Threat Research Unit (TRU). The findings, published November 4, reveal how agentic systems can extend an individual operator’s reach while exposing the limitations of automated cyberattacks.

The operation, dubbed BOSSAI, involved 12 AI agents assigned to tasks ranging from infrastructure management to vulnerability scanning and attempted exploitation. Nine agents were active when researchers examined the environment. Confirmed breaches at universities and emergency services providers resulted in the theft of medical information and personally identifiable information.

TRU uncovered the operation after finding what initially appeared to be a misconfigured development environment. Investigators ultimately examined more than 90,000 files containing approximately 9GB of evidence, including agent conversations, commands, tools and victim data.

The operator, based in Taiwan, coordinated agents with different responsibilities. Some maintained infrastructure, while others scanned targets or attempted intrusions. The agents did not communicate directly with one another. Instead, the operator frequently copied findings from one interface into another, connecting the stages of an attack manually.

In one documented sequence involving a Taiwanese emergency services target, a scanning agent generated findings, another agent assembled an attack-path report and a third was tasked with exploiting the identified weaknesses. The case illustrates how a single person can coordinate multiple specialized tools without building a fully autonomous system.

The investigation also challenges the assumption that commercial AI models will readily execute malicious instructions. According to TRU, commercial models repeatedly refused requests involving vulnerability identification and exploitation, sometimes asking the operator to establish authorization.

The operator consequently relied on locally hosted models modified to remove safety restrictions for much of the offensive work. Those models were less capable and generated unreliable results. Researchers observed fabricated vulnerability findings, failed processes classified as discoveries and excessive volumes of output that complicated the operator’s decisions.

Giving agents broad discretion produced unexpected outcomes, too. In one instance, an agent encountered a Honduran military system but abandoned it because it considered the target outside the assigned scope. The operator’s automation could expand activity, but it did not eliminate human oversight or judgment.

BOSSAI targeted a diverse set of sectors, including government services, education, finance and military-related systems. TRU describes this emerging pattern as an AI-augmented threat actor: An individual using multiple agents to conduct activity that might otherwise suggest a larger, better-resourced group.

For security teams and managed service providers, the lesson is not that every attacker now operates an autonomous AI army. It is that familiar weaknesses can be pursued through increasingly repeatable workflows. Defenders should prioritize visibility into exposed services, prompt remediation of confirmed vulnerabilities, protection of sensitive records and monitoring for suspicious access and data movement.

The investigation also underscores why defenders should distinguish verified compromises from noisy automated findings. AI agents can accelerate reconnaissance and generate reports, but their conclusions still require validation. The research describes a particularly important distinction: commercial models were useful for building and maintaining the surrounding infrastructure, even when they resisted direct offensive requests. That division of labor matters because security teams cannot assess the risk of an agentic operation by looking at any one model in isolation. They need to consider the tools, permissions, operator decisions and handoffs that turn individual outputs into a coordinated campaign.

TRU’s analysis provides a detailed view of the infrastructure, model choices and operational failures behind BOSSAI. Read the full research to understand how the campaign unfolded and what its methods could mean for cyberdefense.