Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records Swati KhandelwalNov 09, 2026Artificial Intelligence / Cyber Espionage A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last week. The agents also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video footage, without a login. The researchers are highly confident that the attacker is a single person based in Hualien City, Taiwan. He aimed the agents at hundreds of organizations in at least 11 countries, including emergency services, banks, universities and military systems. The agents collected data or accessed systems at about 10 of them in Taiwan, Mexico and Thailand. The evidence comes from the attacker's own server, which initially appeared to be a misconfigured development system. It turned out to be his operational attack platform, containing more than 90,000 files, including the agents' conversations, his command history, hacking tools, credentials, and victims' data. The agents did not communicate with each other, so the attacker manually pasted one agent's output into another. Commercial AI models mostly refused to help him attack. The attacking agents therefore ran almost entirely on "abliterated" models, meaning AI models run locally with their safety training removed. Taiwan was targeted far more heavily than any other country, according to the researchers' technical analysis. The most serious confirmed harm there involved emergency-services data. The dispatch records came from a city's system for 119, Taiwan's emergency number for fire and ambulance services. The agents pulled them from the system's API, and they include incident times, response types, case status, and street-level locations. They are case records, not live ambulance tracking. The researchers' summary says breaches at emergency services and universities led to the theft of medical and personal data. Their detailed account of the Taipei patient platform, however, says only that the records were exposed. The agents also went after five other targets tied to Taiwan's emergency services: Fire-dispatch technology vendor Logged into its database admin panel with default root credentials. A web shell attempt through a known CVE failed. Access to 18 or more database tables Emergency management information system Found a hardcoded AES-256 key in the site's front-end JavaScript that exposed session-cookie contents, including an administrator's identity No confirmed compromise National disaster-response center A scanning tool reported a critical Apache remote code execution flaw The flaw did not exist National fire agency single sign-on portal Tried to guess logins (brute force) No confirmed access Fire-department systems in five cities Scanned them to identify the software they run No confirmed compromise The report does not say whether the affected organizations or Taiwan's authorities were told, or whether the exposed data can still be reached. Outside emergency services, the agents pulled data from an account table at a Taiwanese lending firm through SQL injection. In Thailand, they collected data from three universities in the same way, after selecting 489 potential targets across 45 institutions. In Mexico, they collected about 206,800 home phone records containing names and addresses, using government statistics, postal code lists, and telecom authority data. About 15 more organizations were attacked without a confirmed break-in. In at least eight other countries, targets were only scanned or lined up for attacks that had not run by the time the researchers looked. The researchers watched the operation for 12 days. One recorded exchange shows the attacker at work on July 25. The setup, called BOSSAI, had 12 AI agents, with 9 in use. Some built and maintained the attacker's servers and tools, while others scanned targets and carried out attacks. Commercial cloud models did most of the building, with Grok as the main builder. When the attacker directly asked them to attack, Grok and MiniMax M3 refused and requested written proof that the work was authorized. The researchers say it is unclear whether a fake authorization letter would have changed that. Grok made one exception, repairing a broken proof-of-concept script that the attacker then handed to an attack agent. The attacker also redirected the coding agents Claude Code and Codex to an abliterated model, though they mostly did infrastructure work. Cursor, another coding agent, attacked a Taiwanese emergency-services site while running such a model. The abliterated models were versions of DeepSeek, GLM, and Qwen. The agents also got things wrong. One scanning tool invented CVEs, and more than half of its high and critical findings were false positives or wrongly classified. The main attack agent also reported results that had not happened. Acronis's attribution rests on mistakes the attacker made while hiding his identity, combined with publicly available information. He reused a single identity across his legitimate businesses and his attack servers, including a GitHub profile, a logo, an SSH key name, and an email address. His home IP address appeared during an SSH session in one of his Grok conversations. Why he did it is less clear. Some attacks on government, emergency, and military targets looked like the work of state-backed hacking groups, while others looked like ordinary cybercrime. The researchers think he probably wanted to make money, and it is unclear whether he works for anyone. What the agents found was mostly data that was already poorly protected, according to the researchers: a medical data port left open since 2018, dispatch records on a public-facing API, a lender with 16 SQL injection points, and universities running unpatched Oracle databases. The agents failed where logins were enforced, where paywalls required a valid session, and where endpoints were properly filtered. The AI made it cheap to find and reach many targets at once, but it did not get past defenses that held. Nine IP addresses and nine domains from the attacker's setup appear in the indicator list at the end of the analysis. None is marked as active or inactive, and most come without a note on what they were used for. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, Cyber Attack, cyber espionage, data breach, Vulnerability, Web Security Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network AI-Generated Fake Login Pages Are Making Account Takeovers Easier Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Webinar Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk