Acronis’ Threat Research Unit (TRU) has uncovered a cyberattack campaign in which a single operator used a network of 12 artificial intelligence agents to target hundreds of organisations across 11 countries. The operation, identified as BOSSAI, demonstrates how AI-assisted automation is lowering the technical and operational barriers to large-scale cyberattacks.
The investigation found evidence of confirmed system breaches and data theft at around 10 targets across three countries. Other organisations faced active attacks or reconnaissance. Targets included government emergency services, banks, universities, military systems, e-commerce platforms and online gambling websites.
The campaign was reportedly orchestrated by an individual based in Taiwan, who combined AI agents, cybersecurity tools and locally hosted AI models. Each agent performed specialised tasks, including target identification, vulnerability scanning, script development and information extraction. Rather than communicating directly, the agents relied on the operator to transfer findings and coordinate their activities.
A single operator coordinated nine active AI agents to automate reconnaissance and attempted intrusions, exposing sensitive records across multiple sectors.
Among the most serious discoveries was the exposure of sensitive emergency-services data in Taiwan. Patient-care records containing medical information, including ECG readings and vital signs, were accessible without authentication. Emergency dispatch records containing incident details and location information across seven Taipei districts were also accessed.
In Thailand, the researchers documented SQL injection and data extraction involving three universities. The activity included the extraction of administrator tables and attempts to access student records. In Mexico, automated collection and enrichment generated approximately 206,800 residential phone records containing names, addresses and postal codes.
Although BOSSAI comprised 12 agents, nine were active during the investigation. Their coordinated tasks covered infrastructure management, vulnerability assessment, technical analysis and exploitation.
The research also exposed significant limitations in AI-driven attacks. Commercial AI models repeatedly refused explicit offensive requests, prompting the operator to use locally hosted models with safety alignment removed. AI-generated assessments were also unreliable. In the HalberdStrike testing platform, more than half of findings classified as high or critical severity were false positives or misclassifications, increasing the operator’s workload.
The findings suggest that AI agents can help individual attackers conduct reconnaissance and test potential weaknesses at a scale previously associated with larger teams. However, the campaign also depended on human coordination, and many attempted intrusions did not result in confirmed compromises.
Importantly, the successful attacks relied on familiar security weaknesses, including exposed databases, SQL injection, default credentials and inadequate access controls. AI accelerated the process of identifying and testing these vulnerabilities, but did not eliminate the need for exploitable gaps in organisational security.
The investigation reinforces the need for organisations to strengthen access controls, patch vulnerable systems, monitor suspicious activity and regularly validate security configurations. Continuous vulnerability management and data protection remain essential as automated and AI-assisted attacks become more accessible.