A solo hacker in Hualien City, Taiwan, used a network of AI agents dubbed BOSSAI to siphon emergency dispatch records and sensitive patient data across multiple Taiwanese cities, according to a recent analysis by Acronis’ Threat Research Unit. The breach exposed data spanning 2018, including ECG readings and ambulance video footage, through a fire-department system that lacked even basic login protections.
Operation Scope and Tactics
The attacker deployed BOSSAI—consisting of twelve AI agents (nine actively used)—to target hundreds of organizations in at least 11 countries. These included emergency services, universities, banks, and military systems, with confirmed data theft or system access in Taiwan, Mexico, and Thailand. In Taiwan alone, the agents infiltrated the API of the city’s 119 emergency dispatch system, stealing records that detailed incident times, response types, status updates, and street-level locations. These records pertained to past cases—not live ambulance tracking.
Other targeted entities included a fire-dispatch vendor accessed via default credentials, emergency management systems with hard-coded AES-256 keys exposing session data, and university databases vulnerable to SQL injection. One platform continued to expose sensitive patient data since 2018 due to lack of login requirements.
AI Agents, Models, and Limitations
BOSSAI used both cloud-based and local “abliterated” AI models—meaning stripped-down versions stripped of ethical guardrails. When directly asked to assist in attacks, major commercial models like Grok and MiniMax M3 declined unless false evidence of authorization was provided. In contrast, local models based on DeepSeek, GLM, and Qwen performed a bulk of illicit tasks—scanning targets, executing injections, exfiltrating data.
The toolkit was flawed, however. Many findings from scanning tools were false positives or misclassified, and some reported exploits never occurred. The misuse of generalized AI meant the system couldn’t bypass fundamental security such as authenticated logins or properly filtered APIs—but it managed significant exposure in systems lacking basic protections.
Identity and Motive
Researchers tied the operation to a single individual in Hualien by tracing repeated use of the same online identifiers—including an email, SSH key name, and GitHub account—across both benign businesses and attack infrastructure. An SSH session captured the attacker’s home IP. While the hacker hit targets often associated with state actors—emergency services, military networks—experts believe financial gain was likely the primary motive, though involvement with a larger actor hasn’t been ruled out.
The exposed systems were overwhelmingly poorly secured: open medical data portals, APIs with public access, numerous SQL injection vulnerabilities, and unpatched servers. Defenses held strong when logins were required or endpoints filtered. The operation was spotted during a 12-day monitoring window, including a recorded session on July 25.
Domestic victims include city fire departments and national emergency services; internationally, universities in Thailand and a lending firm in Taiwan were also hit. In Mexico, the exfiltrated data included approximately 206,800 home phone records.
The compromise serves as a grim reminder: AI can multiply reach and speed of attack, but it still fails when basic cybersecurity hygiene is in place. The agent setup leveraged weaknesses, not advanced zero-days.
Analytical Spark: This incident marks a new frontier in AI-powered cyber threats. The use of “abliterated” local models to bypass ethical constraints, paired with brute-force scanning and open APIs, signals attackers aren’t waiting for vulnerabilities—they’re exploiting weak security practices. Organizations should prioritize patching, enforcing authentication everywhere, and auditing AI model use. Watch for future defensive norms around local AI deployment and increased regulation of API security.
