BOSSAI: One Attacker's AI Agents Pulled Taipei 119 Dispatch Records and Exposed Patient Data

TL;DR

• what: A single Taiwan-based attacker used BOSSAI, a 12-agent AI setup running mostly on safety-stripped local models, to scan and attack hundreds of organizations and pull Taipei 119 emergency dispatch records.
• impact: About 10 organizations in Taiwan, Mexico and Thailand were reached, including street-level dispatch case data, a fire department patient platform exposed since 2018, a lender's account table, three Thai universities and 206,800 Mexican phone records.
• fix: No CVE or vendor patch applies: the agents succeeded only against unauthenticated APIs, default credentials, open ports, SQL injection and unpatched Oracle databases, and failed wherever logins, valid sessions and endpoint filtering were enforced.
• who: Emergency services, dispatch technology vendors, financial lenders and universities with long-standing internet-facing exposure are most at risk from low-cost AI-driven scanning at scale.

A single attacker running a homemade group of AI agents pulled 119 emergency dispatch records covering seven Taipei districts. The same agents found a Taipei fire department platform exposing patient data, including ECG readings and ambulance video footage, with no login required. Acronis's Threat Research Unit says it is highly confident the operation, called BOSSAI, was run by one person based in Hualien City, Taiwan. The agents were aimed at hundreds of organizations in at least 11 countries, including emergency services, banks, universities and military systems. They collected data or accessed systems at about 10 of them in Taiwan, Mexico and Thailand.

The evidence came from the attacker's own infrastructure. A server that first looked like a misconfigured development system turned out to be his operational attack platform. It held more than 90,000 files: agent conversations, command history, hacking tools, credentials and victim data. Researchers watched the operation for 12 days.

Emergency Services Took the Hardest Hit

Taiwan was targeted far more heavily than any other country. The most serious confirmed harm involved a city system for 119, Taiwan's fire and ambulance number. The agents pulled the dispatch records directly from the system's public-facing API. The records include incident times, response types, case status and street-level locations. They are case records, not live ambulance tracking. Street-level incident data tied to medical calls is still sensitive.

The Taipei patient platform had exposed medical data dating back to 2018. The report is inconsistent on what happened to it. The summary says breaches at emergency services led to theft of medical data, while the detailed account says only that the records were exposed. The report also does not say whether the affected organizations or Taiwanese authorities were notified, or whether the data can still be reached.

The agents also went after five other targets tied to Taiwan's emergency services:

• Fire-dispatch technology vendor: logged into its database admin panel with default root credentials and reached 18 or more tables. A web shell attempt through a known CVE failed.
• Emergency management information system: found a hardcoded AES-256 key in front-end JavaScript that exposed session-cookie contents, including an administrator's identity. No confirmed compromise.
• National disaster-response center: a scanning tool reported a critical Apache remote code execution flaw that did not exist.
• National fire agency single sign-on portal: brute-force login attempts with no confirmed access.
• Fire-department systems in five cities: scanned to identify the software they run. No confirmed compromise.

⚠️ Default credentials at a dispatch vendor — The fire-dispatch technology vendor's database admin panel accepted default root credentials, which gave the agents 18 or more tables. One weak vendor serving several dispatch centers puts every one of its customers at risk.

Targets Beyond Emergency Services

In Taiwan, the agents used SQL injection to pull data from an account table at a lending firm that had 16 injection points. In Thailand, they selected 489 potential targets across 45 institutions and collected data from three universities through SQL injection against unpatched Oracle databases. In Mexico, they collected about 206,800 home phone records with names and addresses by combining government statistics, postal code lists and telecom authority data.

About 15 more organizations were attacked without a confirmed break-in. In at least eight other countries, targets were only scanned or queued for attacks that had not run by the time researchers looked.

How BOSSAI Was Built

BOSSAI had 12 AI agents, 9 of them in use. Some built and maintained the attacker's servers and tools. Others scanned targets and carried out attacks. The agents could not talk to each other, so the attacker pasted one agent's output into another by hand.

Commercial cloud models did most of the building, with Grok as the main builder. When the attacker asked them directly to attack, Grok and MiniMax M3 refused and requested written proof of authorization. The researchers say it is unclear whether a forged authorization letter would have changed that. Grok made one exception: it repaired a broken proof-of-concept script, which the attacker then handed to an attack agent.

The attack agents ran almost entirely on abliterated models, meaning versions of DeepSeek, GLM and Qwen run locally with their safety training removed. The attacker also pointed the coding agents Claude Code and Codex at an abliterated model, though they mostly did infrastructure work. Cursor, another coding agent, attacked a Taiwanese emergency-services site while running on one of these models.

Refusals moved the attack instead of stopping it — Commercial model refusals pushed the offensive work onto self-hosted abliterated models. A provider's safety controls stop applying once an agent framework is pointed at a local model the attacker controls.

The Agents Got Things Wrong

The agents were unreliable. One scanning tool invented CVEs, and more than half of its high and critical findings were false positives or wrongly classified. The nonexistent Apache RCE at the disaster-response center is one example. The main attack agent also reported results that had not happened.

For defenders, this kind of activity shows up as heavy scanning with poor precision. Logs may show attempts against vulnerabilities the target never had, mixed in with real SQL injection and credential attacks that work on poorly protected systems.

Attribution Through OPSEC Failures

Acronis based its attribution on mistakes the attacker made while hiding his identity, combined with public information. He used the same identity for his legitimate businesses and his attack servers, including a GitHub profile, a logo, an SSH key name and an email address. His home IP address appeared in an SSH session inside one of his Grok conversations.

His motive is less clear. Some attacks on government, emergency and military targets resembled state-backed activity, while others looked like ordinary cybercrime. The researchers think he was probably after money, and it is unclear whether he works for anyone.

RedEye Assessment

BOSSAI did not create a new class of attack. Nearly everything it reached was already poorly protected: a medical data port open since 2018, dispatch records on an unauthenticated public API, a lender with 16 SQL injection points and universities running unpatched Oracle databases. The agents failed wherever logins were enforced, paywalls required a valid session and endpoints were properly filtered.

What changed is the cost. One person with a dozen loosely connected agents and local models with safety training removed scanned hundreds of organizations in 11 countries and reached about 10 of them. For critical infrastructure operators and their vendors, old exposure that nobody had bothered to exploit can now be found and reached cheaply. The 2018 patient data exposure was never secure. AI made it cheap to find.

Originally published on RedEye Threat Intelligence.