BOSSAI: one operator ran 12 AI agents against hundreds of targets

01What happened

Acronis Threat Research Unit published the BOSSAI investigation on 4 November 2026, after finding what first looked like a misconfigured development environment holding more than 90,000 files and 9GB of logs, chat histories, exploit tools and victim data. The material covered attacks on hundreds of organizations in 11 countries. Acronis assesses with high confidence that one person in Hualien City, Taiwan, ran the whole operation.

02How it works

Twelve agents split the work, nine of them active at the time of the investigation. Builder agents including Grok, OpenClaw, Claude Code and Codex set up infrastructure, while attack agents including Hermes, Cursor, Trae and CyberStrike scanned targets and wrote exploits on top of MCP servers such as HexStrike AI, a Kali server and a Ghidra bridge. Commercial models refused the offensive requests, so the attack agents moved onto abliterated open-weight models, mainly DeepSeek, GLM and Qwen variants. None of the agents talked to another: the operator copied output between them by hand.

03Who is affected

Emergency services, universities and public-sector systems with weak authentication took the confirmed hits, including a Taipei fire-department patient-care platform that exposed ECG readings and patient vital signs without a login, and a city 119 dispatch system whose case records were pulled. Acronis counts about 10 confirmed breaches across three countries, about 15 further targets attacked without confirmed compromise, and reconnaissance or staging against entities in eight more countries.

04What to do

Assume an exposed legacy service will be found: Acronis reports the agents failed wherever authentication and endpoint filtering were enforced, and succeeded against unauthenticated data ports and unpatched databases. Block the IP addresses and domains in the report's indicators section, and check logs for them.

Questions people ask

Which AI models did the BOSSAI operator use for the attacks?

BOSSAI's attack agents ran on abliterated open-weight models, mainly DeepSeek, GLM and Qwen variants, with an abliterated DeepSeek-V4 build called DS4 as the final default. Acronis reports that commercial models refused the offensive requests, and that Grok turned down every explicit attack request except one that repaired a broken proof-of-concept script. Infrastructure agents kept using commercial models.

How accurate were the BOSSAI agents' findings?

Accuracy was poor on the scanning side. Acronis reports that over half of HalberdStrike's high-severity and critical findings were false positives or misclassifications, and that against a national disaster-response center the agent reported a critical Apache remote code execution flaw that did not exist. Re-examination downgraded every finding there to a false positive or a misclassified negative.

How did Acronis identify the BOSSAI operator?

Acronis attributes BOSSAI with high confidence to one individual in Hualien City, Taiwan, on operational security failures rather than a single clue. The investigators found reused branding across the infrastructure, shared SSH key identities, a linked GitHub account, hardcoded credentials, and a home IP address that the operator exposed inside a Grok conversation saved in the recovered logs.

Is BOSSAI the same campaign as the CyberStrikeAI intrusions Kaspersky reported?

BOSSAI is a separate investigation. Acronis describes one operator in Taiwan whose agent mesh used CyberStrike among several tools, found through the operator's own exposed logs. Kaspersky's CyberStrikeAI write-up covers intrusions at education targets where an LLM chose the commands during a three day domain takeover. The two reports share a tool name, not a campaign.

Sources 3 links, all fetched

1. 1acronis.comAcronis TRU Report
2. 2acronis.comAI Supply Chain Attacks
3. 3anthropic.comAnthropic Misuse Report