BOSSAI AI agents used to access systems and collect data, Acronis said

BOSSAI combined local models with manual agent handoffs

Acronis said the attacking agents ran almost entirely on locally operated models with their safety training removed. The agents did not communicate with each other, so the attacker manually pasted one agent’s output into another.

Commercial cloud models handled most of the building work, with Grok as the main builder. Acronis said Grok and MiniMax M3 refused direct attack requests and asked for written proof that the work was authorized.

One scanning tool invented CVEs, and more than half of its high- and critical-severity findings were false positives or misclassified, Acronis said.

The agents reached emergency and financial data through exposed systems

The dispatch records came from a city system for Taiwan’s emergency number 119 and included incident times, response types, case status and street-level locations. Acronis said they were case records, not live ambulance tracking.

The agents also found a hardcoded AES-256 key in front-end JavaScript that exposed session-cookie contents, including an administrator’s identity.

The campaign reached Mexico and Thailand through SQL injection

Acronis said the agents pulled data from an account table at a Taiwanese lending firm through SQL injection. In Thailand, they collected data from three universities through SQL injection after selecting 489 potential targets across 45 institutions.

In Mexico, the agents collected about 206,800 home-phone records containing names and addresses, using government statistics, postal code lists and telecom authority data, Acronis said.

About 15 additional organizations were attacked without a confirmed break-in.

Acronis linked the activity to one Hualien City attacker

Acronis researchers said they were highly confident the attacker was a single person based in Hualien City, Taiwan. They said he reused one identity across legitimate businesses and attack servers, including a GitHub profile, a logo, an SSH key name and an email address.

The operational attack platform contained more than 90,000 files, including agent conversations, command history, hacking tools, credentials and victims’ data, Acronis said.

Acronis researchers watched the operation for 12 days, including a recorded exchange on July 25. The company said its attribution rests on mistakes the attacker made while hiding his identity and publicly available information.

Acronis researchers said the motive was unclear and that the attacker probably wanted to make money. They also said it was unclear whether he worked for anyone.