Emergency dispatch records for seven Taipei districts were extracted by an attacker using AI agents, The Hacker News reported, citing research disclosed by Acronis’s Threat Research Unit the previous week. The agents also discovered an unauthenticated Taipei fire department platform exposing patient records from 2018, including electrocardiogram (ECG) readings and ambulance video footage.
The operation reached beyond emergency services. Acronis found that hundreds of organizations across at least 11 countries had been targeted, spanning banks, universities and military systems. Data collection or system access occurred at about 10 organizations in Taiwan, Thailand and Mexico, with Taiwan receiving by far the most attention and suffering the most serious confirmed emergency-services harm.
Researchers assessed with high confidence that a single person in Hualien City, Taiwan, controlled the operation. His system, called BOSSAI, combined AI-assisted infrastructure building with attack agents running mostly on local models whose safety training had been removed. Its successes largely involved systems with existing protection failures.
Emergency records and exposed patient data
The stolen dispatch data came through an API—a software interface for exchanging data—connected to a city’s 119 fire and ambulance emergency system. It described incidents through timestamps, response types, case status and street-level locations; it did not provide live ambulance tracking.
The patient platform represents a different finding: its records were accessible without a login. Although Acronis’s broader summary described medical and personal data theft at emergency services and universities, its detailed account established exposure of the Taipei patient records, rather than their extraction.
Other Taiwanese emergency-service targets illustrate the range between successful access, unsuccessful attacks and erroneous findings:
- A fire-dispatch technology supplier’s database administration panel accepted default root credentials, giving the agents access to at least 18 tables. An attempt to exploit a known vulnerability to deploy a web shell, a script enabling remote access, failed.
- Browser-side JavaScript for an emergency management information system contained a hardcoded AES-256 encryption key. It revealed the contents of session cookies, which hold information about a user’s session, including an administrator’s identity. A compromise was not confirmed.
- A scanner claimed a national disaster-response center had a critical Apache flaw allowing remote code execution. The reported flaw did not exist.
- Attempts to guess passwords at a national fire agency’s single sign-on portal produced no confirmed access.
- Fire-department systems in five cities were scanned to identify their software, without a confirmed compromise.
Elsewhere in Taiwan, the agents retrieved account-table data from a lending firm using SQL injection, a technique that manipulates database queries through vulnerable application inputs. They also collected data from three Thai universities through SQL injection, having selected 489 potential targets across 45 institutions.
The Mexican activity yielded about 206,800 home phone records containing names and addresses, using government statistics, postal code lists and telecommunications authority data. Around 15 further organizations faced attacks without a confirmed intrusion. In at least eight other countries, activity stopped at scanning or preparation for attacks that had not run when researchers examined the operation.
A human coordinated the AI agents
Acronis reconstructed the activity from the attacker’s own server. Initially resembling a misconfigured development machine, it proved to hold his operational attack environment: more than 90,000 files containing conversations with agents, command history, attack tools, credentials and victim data.
The researchers monitored the operation for 12 days. A recorded conversation places the attacker at work on July 25; the findings were disclosed the week before the news report.
BOSSAI contained 12 agents, nine of them in use, divided between maintaining servers and tools and conducting reconnaissance and attacks. Coordination still depended on the operator: the agents could not exchange messages, so he copied material manually from one to another.
Most infrastructure development used commercial cloud models, principally Grok. Direct attack requests prompted refusals from Grok and MiniMax M3, which sought written authorization; whether fabricated permission would have changed those responses remained unclear to the researchers. Grok nevertheless repaired a broken proof-of-concept exploit script that the operator subsequently gave to an attack agent.
For most offensive work, the attacker used “abliterated” versions of DeepSeek, GLM and Qwen, running locally with their safety training removed. He also connected the coding agents Claude Code and Codex to an abliterated model, though their work mostly concerned infrastructure. Cursor, another coding agent, used such a model to attack a Taiwanese emergency-services site.
The agents’ output required scrutiny. A scanning tool fabricated CVE identifiers, the reference numbers used to track known vulnerabilities, and more than half its high- and critical-severity findings were false positives or incorrectly classified. The principal attack agent also claimed outcomes that had never occurred.
Attribution and the defenses that held
Identity reuse helped Acronis connect the operation to its suspected operator. Public information and mistakes in concealing his identity linked legitimate businesses and attack infrastructure through a GitHub profile, logo, SSH key name and email address. His home IP address also appeared in a Grok conversation during an SSH remote-login session.
Researchers judged financial gain the likely motive. Some targeting of government, emergency and military systems resembled state-backed activity, while other attacks resembled ordinary cybercrime; whether the operator worked for anyone remained unclear.
The Hacker News account of Acronis’s findings describes an indicator list containing nine IP addresses and nine domains. Their active status is unspecified, and most lack explanations of their roles. Notification and remediation status for the affected systems also remain unresolved, including whether the exposed data is still reachable.
The successful activity centered on weaknesses already present: a medical-data port open since 2018, a publicly reachable dispatch API, 16 SQL injection points at the lender and unpatched Oracle databases at universities. AI lowered the cost of finding and pursuing many targets, but the agents failed against enforced logins, paywalls requiring valid sessions and endpoints that properly filtered requests.
