Acronis details BOSSAI, a twelve-agent AI attack mesh run by one operator from Taiwan

The setup

A report from the Acronis Threat Research Unit, published on November 4, documents an attack campaign in which a single operator in Hualien City, Taiwan, used a mesh of twelve AI agents against hundreds of organizations across eleven countries. Researchers gained an unusually complete view of the operation because the operator left his entire platform exposed on a misconfigured server: more than 90,000 files containing agent conversations, command histories, credentials and victim data. Acronis observed the campaign over twelve days, and a dev.to write-up published this week walks through the findings.

The system, named BOSSAI, had nine active agents divided into roles resembling a small engineering team. Builder agents — Grok, OpenClaw, Claude Code and Codex — set up infrastructure such as MCP servers, DNS, proxies and messaging-app gateways. Attack agents, led by one called Hermes and backed by Cursor, Trae and CyberStrike, handled scanning and exploitation. At its peak the platform ran thirteen MCP servers wrapping Kali Linux tooling including nmap, sqlmap, Metasploit and Hydra, along with Ghidra, Playwright and OSINT and CVE lookup services, later trimmed to three. One structural detail stands out: the agents never communicated directly. The operator was the integration layer, manually pasting one agent's output into another's terminal, sometimes from his phone over WeChat or LINE.

Local, stripped-down models did the offensive work

According to the report, commercial cloud models refused to participate. Grok and MiniMax M3 rejected direct attack requests and demanded written proof of authorization, and Chinese open-source models likewise refused while lecturing the operator on cyber law. The offensive core therefore ran on "abliterated" local models — DeepSeek, GLM and Qwen variants with safety alignment removed — served from two RTX 4090 GPUs through llama.cpp. Hermes, the primary attack agent, rotated through at least nine models over nineteen days before settling on an abliterated DeepSeek-V4 variant. As the dev.to analysis puts it, the effective safety barrier here was hardware cost, not model policy.

What the mesh actually breached

Taiwan absorbed the worst of it. The agents pulled emergency dispatch records covering seven Taipei districts from the 119 system's public-facing API, including incident times, response types, case status and street-level locations. They found a Taipei fire department platform that had exposed patient data without any login since 2018, including ECG readings and ambulance video. Default root credentials gave them access to a fire-dispatch vendor's database admin panel and at least eighteen tables. Further afield: account data from a Taiwanese lender via sixteen SQL injection points, data from three Thai universities selected from 489 candidates across 45 institutions, and roughly 206,800 Mexican home phone records with names and addresses. About fifteen more organizations were attacked without a confirmed break-in.

Notably absent from the list is a sophisticated exploit. Every confirmed compromise involved a door left open — a listening port dating to 2018, a public API, factory credentials, unpatched Oracle databases, ordinary SQL injection.

Where it broke down

The failure log may be the most useful part for defenders. The scanning layer hallucinated vulnerabilities: more than half of its high and critical findings were false positives or misclassified, including a fabricated "critical Apache RCE" at a national disaster-response center. The attack agent reported successes that had not actually occurred. The agents produced more output than one operator could triage. And in one curious case, the agents declined to attack a Honduran military base, judging it out of scope — an autonomous judgment no human attacker would likely have made, one that both scaled the operation and quietly limited it.

The operator himself was identified the traditional way. He reused a single identity — GitHub profile, logo, SSH key name, email — across his legitimate businesses and attack infrastructure, and his home IP surfaced in an SSH session captured inside one of his own Grok conversations.

Why it matters

By Acronis's own analysis, the agents failed wherever logins were enforced, valid sessions were required and endpoints were properly filtered. Everything that stopped a twelve-agent AI attack mesh was conventional, decades-old access control. What the AI changed is economics: reconnaissance and low-grade exploitation are now nearly free, so neglected weaknesses that once went unnoticed can be found by cheap, tireless machinery in the hands of a single motivated individual. The report also cuts both ways — hallucinated findings and unreviewable volume limited the operation — and shows that frontier-model refusals simply push attackers toward locally hosted, alignment-stripped models that no provider gate can reach. The Hacker News, which covered the report on November 9, framed the core question the same way: it is no longer whether an attacker would bother with you, but whether your authentication, patching and filtering are already in place when the machine arrives.