A cyberattack campaign involving a network of artificial intelligence (AI) agents targeted hundreds of organisations across 11 countries, according to an investigation by Acronis. The campaign, identified as BOSSAI, involved a single operator using 12 specialised AI agents to identify potential targets, scan systems and attempt intrusions.
The investigation by the Acronis Threat Research Unit (TRU) found evidence of confirmed breaches and data theft at around 10 targets across three countries. Other organisations were subjected to reconnaissance or attempted attacks.
The campaign targeted a range of organisations, including emergency services, financial institutions, universities, military systems and e-commerce platforms. The findings provide an example of how AI agents and automated security tools can be combined to conduct cyber operations across multiple targets.
AI agents used for reconnaissance and exploitation
According to the investigation, the operator built a network of AI agents, cybersecurity tools and locally hosted AI models. Each agent was assigned a specific role, including target identification, vulnerability scanning, technical analysis, script development and data extraction.
The 12-agent system was coordinated by the operator, who manually transferred results between agents. The agents did not communicate directly with one another.
Nine of the 12 agents were active during the investigation. The operator used a combination of open-source security tools and AI agent frameworks to automate parts of the attack process.
The investigation found that the approach enabled the operator to scan and assess a large number of potential targets. However, the operation also required manual coordination and verification of the results produced by the agents.
Emergency services data exposed in Taiwan
One of the significant findings involved emergency services in Taiwan, where the investigation identified unauthenticated access to sensitive patient-care records.
The exposed information included medical data such as electrocardiogram (ECG) readings and patient vital signs. The operator also accessed emergency dispatch records containing incident details and location information across seven districts of Taipei.
The findings highlight the risks associated with inadequate access controls, particularly in systems handling sensitive medical and emergency-response information.
Universities and other organisations targeted
In Thailand, the investigation documented SQL injection attacks and data extraction attempts involving three universities.
At one institution, the operator’s agents extracted an administrator table and attempted to access student records. At other universities, the investigation documented database extraction that included student information.
In Mexico, automated data collection and enrichment resulted in approximately 206,800 residential phone records containing names, addresses and postal codes.
Acronis said the campaign also targeted organisations across several other sectors, including banking, government, military systems and online services.
AI models and automated tools have limitations
The investigation also identified limitations in the use of AI agents for offensive cyber operations.
Commercial AI models repeatedly refused requests for offensive activities, including attempts to bypass their safety restrictions. The operator subsequently used locally hosted models with safety alignment removed for much of the offensive activity.
The research also found that AI-generated vulnerability assessments were not always accurate. In testing involving the HalberdStrike platform, more than half of findings classified as high severity or critical were false positives or misclassifications.
These inaccuracies increased the operator’s workload and highlighted the need to verify AI-generated findings before acting on them.
The investigation found that many attempted intrusions did not result in confirmed compromise. Successful attacks often involved familiar security weaknesses, including exposed databases, SQL injection vulnerabilities, default credentials and inadequate access controls.
Security implications for enterprises
The BOSSAI investigation highlights how AI agents can help individuals automate parts of cyberattack operations, including reconnaissance, vulnerability scanning and data collection.
However, the findings also show that AI does not eliminate the need for technical expertise or human coordination. The operator had to manage the agents, assess their findings and verify whether attempted intrusions had succeeded.
For enterprises, the findings underline the importance of maintaining effective access controls, patching vulnerable software, monitoring suspicious activity and regularly validating security configurations.
Acronis said continuous vulnerability management and data protection measures can help organisations reduce their exposure to automated attacks.