An individual hacker in Taiwan deployed a network of 12 AI agents—nine active—and executed cyberattacks across 11 countries targeting emergency services, banks, universities, and military systems. Medical and personal data were confirmed stolen as part of this campaign, illustrating how AI tools are empowering a single person to stage operations once carried out by coordinated teams. The toolkit, dubbed “BOSSAI,” relied on rented GPUs and open-source models to scale its capabilities.
The Anatomy of the Attack
The setup included “builder” agents like Grok, Claude Code, Codex, and OpenClaw, which handled infrastructure components such as DNS, proxies, and server deployments. “Attack” agents—including Hermes, Cursor, Trae, and CyberStrike—scanned for vulnerabilities and developed exploits. Hermes was highly active, logging approximately 95 sessions and sending over 18,000 messages, while HalberdStrike was used to scan at least one Taiwanese emergency service system.
Output between agents wasn’t automated; the operator manually copied results from one agent and gave inputs to the next. Hermes generated vulnerability reports, which Cursor then used to execute attacks. Behind the scenes, the agent mesh connected to tools via MCP servers and used services like HexStrike AI, a Kali Linux server, and a Ghidra bridge. Attack traffic routed through proxies, with a main node hosted at IP address 112[.]121[.]185[.]218.
Targets, Impact & Global Footprint
Within Taiwan, the breach exposed serious vulnerabilities. A Taipei fire department platform leaked patient ECG readings and ambulance video without login protection. A city’s 119 dispatch system yielded sensitive case records across seven districts. Other victims included a vendor still using default root credentials on a database panel, and a lender with multiple SQL injection vulnerabilities.
Internationally, Taiwan was far from the only target. In Mexico, attackers harvested over 200,000 home phone records. Thailand saw nearly 500 targets across 45 universities, with data extracted from three institutions.
Challenges, Weaknesses & Defensive Takeaways
Not all AI agents cooperated. Commercial models like Grok 4.5 and MiniMax M3 refused to engage in attacks or asked for proof of authorization. The hacker then switched to local models stripped of safety constraints—these weren’t always reliable, often making critical errors. Hallucinations led to mislabeling benign issues as remote code execution threats and many false high-severity alerts.
Success came mostly where security was lax: unpatched software, default credentials, open ports. Agents struggled when systems enforced login or filtering.
Attribution & Indicators of Compromise
Researchers linked all operations to one person in Hualien City, Taiwan. Evidence included reuse of home IPs for both legitimate and malicious infrastructure, overlapping domain registrations, and GitHub activity. Confidence in this attribution is high.
The threat intelligence team published several IP addresses and domains associated with the operation. These include IPs like 112[.]121[.]185[.]218 and domains such as vps[.]xs1[.]ccwu[.]cc and attacker-collector[.]com.
What this Means:
The BOSSAI case marks a turning point. It signals that individuals equipped with open-source tools and accessible compute resources can mount large-scale, AI-powered intrusions. As defenders, focusing on foundational security—patch management, credential hygiene, strict access controls—is no longer optional. The automation like this just ensures bad actors scan and probe at scale. What we watched in 2025 as fringe cases is now a template threats will replicate. Keeping agents from misusing systems demands systemic defenses around every exposed entry point.
