A single individual used a network of AI agents to scan and attack hundreds of organisations across 11 countries, according to an investigation by the Acronis Threat Research Unit (TRU). The researchers say the operation, which they call BOSSAI, led to confirmed breaches and data theft at around 10 targets in three countries.

Acronis says the operator built a setup of 12 specialised AI agents, nine of them active during the investigation, along with open-source security tools, agent frameworks and locally hosted AI models. Each agent had a defined job, from identifying targets and scanning for weaknesses to writing scripts and extracting information. The agents did not talk to each other. Instead, the operator moved results from one to another by hand, coordinating work across infrastructure management, vulnerability scanning, technical analysis and exploitation. Acronis says the individual is based in Taiwan.

The targets ranged widely: government emergency services, banks, universities, military systems, e-commerce platforms and online gambling websites. Beyond the roughly 10 confirmed compromises, several other organisations faced active attacks or reconnaissance.

The most sensitive finding concerns Taiwan’s emergency services. Acronis says patient-care records, including ECG readings and vital signs, were accessible without authentication, and that the attacker reached emergency dispatch records with incident details and location information across seven districts of Taipei. In Thailand, the researchers documented SQL injection and data extraction at three universities; at one, agents pulled an administrator table and tried to dump student records, and at others the team recorded database extraction that included student information. In Mexico, automated collection and enrichment produced about 206,800 residential phone records with names, addresses and postal codes.

The report is as notable for what the AI did badly. Commercial AI models repeatedly refused explicit offensive requests, including attempts to get around their safety restrictions, so the operator relied on locally hosted models with safety alignment removed for much of the offensive work. The agents also produced wrong results, including vulnerabilities that did not exist. In the HalberdStrike testing platform, more than half of the findings rated high severity or critical were false positives or misclassifications. Those errors added to the operator’s workload, Acronis says, and show the risk of trusting AI-generated assessments without checking them. Many attempted intrusions also failed to produce a confirmed compromise.

The successful intrusions leaned on well-known weaknesses: exposed databases, SQL injection, default credentials and weak access controls. Acronis draws two conclusions. AI is changing how attacks are planned and run, because work that once needed several skilled people can increasingly be handled by one person with agents and automation. But the basics still decide outcomes, and the company recommends strong access controls, timely patching, monitoring for suspicious activity and regular validation of security configurations.