One hacker used 12 AI agents against targets in 11 countries
Acronis says the agents won only where protection was weak, for example with default passwords.
Acronis Threat Research Unit says one person in Taiwan made a team of 12 AI agents with the name BOSSAI. The team attacked hundreds of organizations in 11 countries, with emergency services, banks, universities and military systems. Acronis tied the setup to a person in Hualien City with high confidence, and the agents stole medical data.
How it works
Some agents wrote code, some scanned websites and some did the attacks. The agents did not speak to each other. The operator copied the output of one tool and pasted it into the next.
The numbers
- The agents took about 206,800 phone records of residents in Mexico.
- A Taipei fire-department platform showed heart data and ambulance video with no login.
- In Thailand, the agents found 489 targets across 45 universities.
What is not known
Models from AI vendors refused to help and wanted written authorization. The operator then used local models with the safety rules removed. These models made errors: more than half of the high-severity results of one scanner were incorrect.
Insight: Agents hit the weakest target first
The 12 agents won only where protection was weak. CrowdStrike says a China-linked group told its agents to find computers with no CrowdStrike sensor. Snorre Fagerland estimates about $50 for each break-in. This reads as a game of volume: agents try all targets, and the weakest are hit first. Defenders win when they close weak points first.
Sources
Posted
