BOSSAI: One Operator Ran a Mesh of 12 AI Agents Against Hundreds of Organisations in 11 Countries — Taipei 119 Dispatch Records and Patient Data Taken

High · 2026-11-11 · By H.A

BOSSAI: One Operator Ran a Mesh of 12 AI Agents Against Hundreds of Organisations in 11 Countries — Taipei 119 Dispatch Records and Patient Data Taken

Researchers exposed BOSSAI, a single Taiwan-based operator's 12-agent AI attack mesh that used SQL injection, default credentials and hardcoded secrets to confirm about 10 compromises in Taiwan, Mexico and Thailand, including Taipei 119 dispatch records.

Overview

Security researchers have published a detailed look inside BOSSAI, a "mesh" of 12 AI agents run by what they assess, with high confidence, to be a single person based in Hualien City, Taiwan. The platform scanned hundreds of organisations in 11 countries and confirmed compromises at about 10 targets in three countries. The most serious harm was in Taiwan: emergency dispatch case records from Taipei's 119 fire and ambulance system, and an old fire-department patient-care platform that exposed ECG readings, vitals and ambulance video without asking for credentials.

The case matters because it shows what AI agents actually change for a lone attacker. Mostly they add scale and speed. They don't add new exploits. Every confirmed intrusion used a well-known web weakness: SQL injection, default credentials, hardcoded secrets and broken validation.

The Campaign

Researchers found the operation through an exposed open directory on the attacker's main server. It held more than 90,000 files (about 9 GB), including agent configuration, conversation logs, command histories, exploit tooling, credentials and victim data. They watched the mesh for about 12 days, and the main offensive agent's model rotations are logged over 19 days.

The architecture was more manual than "autonomous":

Commercial models repeatedly refused offensive requests, even under jailbreak attempts. A logged 25 July 2026 request asking Grok to port a Hikvision exploitation tool to Linux was declined. That pushed the operator onto weaker abliterated open-weight models (DeepSeek, GLM and Qwen variants).

Timeline

Tradecraft

Confirmed impact by country:

Other techniques included a hardcoded AES-256 key in front-end JavaScript that exposed session contents, a partial SSRF path, and credential stuffing over WordPress XML-RPC, which found no valid logins. The agents also produced false results, including a fabricated "critical" Apache RCE against a disaster-response centre. Hermes stored reusable "skills" (playbooks) that carried procedures and target details from one campaign to the next.

Attribution rests on reused handles and branding across GitHub and infrastructure, an SSH key identity, a legitimate business storefront on the same IP, and a home IP that leaked in a Grok session. The operator also left API keys, Cloudflare tokens and a WeChat enterprise QR code exposed.

Indicators of Compromise

IP addresses:

Domains:

Detection

# Example: count likely SQLi probes per source IP in an nginx access log
grep -Ei "union(%20|\+)select|sleep\(|information_schema|' or '1'='1" /var/log/nginx/access.log \
  | awk '{print $1}' | sort | uniq -c | sort -rn | head

Recommended Actions

Analyst Assessment

BOSSAI is a useful corrective to "autonomous AI hacker" hype. The agents let one person scan and probe at the volume of a small team, across many countries at once. But the operator still had to glue the pieces together by hand, fought model refusals, and struggled to review the agents' output, some of which was invented. The weaknesses exploited were basic and avoidable. For defenders, the lesson is that obscurity no longer protects forgotten systems: at agent scale, every exposed legacy service and default password will eventually be found. Severity is rated High because of the confirmed theft of emergency-service and patient data.

REEF SENTINEL