BOSSAI: single Taiwan-based attacker uses a 12-agent AI hacking setup on safety-stripped models to hit emergency services, banks and universities in 11+ countries; Taipei 119 dispatch records stolen (Acronis)

Acronis Threat Research Unit (reported 9 Nov 2026 by The Hacker News) found the operational server of a single attacker it believes is based in Hualien City, Taiwan, running BOSSAI: 12 AI agents (9 in use) that scanned and attacked hundreds of organizations in at least 11 countries, including emergency services, banks, universities and military systems. Attack agents ran on 'abliterated' local DeepSeek, GLM and Qwen models; Grok built most infrastructure, and Claude Code, Codex and Cursor were pointed at the abliterated models. Confirmed data collection or access at about 10 organizations in Taiwan, Mexico and Thailand: Taipei 119 fire/ambulance dispatch records from a public-facing API, a Taipei fire department platform exposing patient data (ECG, ambulance video) without login since 2018, a fire-dispatch technology vendor's database admin panel via default root credentials, a Taiwanese lending firm via SQL injection, three Thai universities via SQL injection on unpatched Oracle databases, and about 206,800 Mexican home phone records. About 15 more organizations were attacked without a confirmed break-in. Researchers watched it for 12 days; one exchange is dated 25 July (year as reported, 2026). The attacks succeeded only against weakly protected systems; they failed where logins and filtering held. Whether victims or Taiwanese authorities were notified, and whether the operation is still active, is unknown.