Single attacker uses local AI agents to breach Taipei emergency services

Researchers at Acronis's Threat Research Unit reported last week that a single attacker based in Hualien City, Taiwan, used a suite of AI agents to compromise emergency service systems. The operation targeted hundreds of organizations across at least 11 countries, successfully extracting sensitive dispatch records and medical data from vulnerable endpoints in Taiwan, Mexico, and Thailand.

What happened

The attacker operated a custom framework called BOSSAI, which consisted of 12 AI agents, nine of which were actively used during the campaign. These agents performed various roles, including server maintenance, target scanning, and executing attacks. Because commercial cloud-based AI models like Grok and MiniMax M3 largely refused to assist with malicious tasks, the attacker relied on "abliterated" models. These are locally hosted versions of open-source AI systems, such as DeepSeek, GLM, and Qwen, that have had their safety training and ethical guardrails removed.

The investigation revealed that the agents did not communicate autonomously. Instead, the attacker manually copied output from one agent and pasted it into another to coordinate the attack chain. Evidence was recovered from the attacker’s own server, which was initially mistaken for a misconfigured development environment. In reality, it served as the operational hub for the campaign, containing over 90,000 files. This archive included command histories, hacking tools, stolen credentials, victim data, and logs of the AI agents' conversations.

The most significant breaches occurred in Taiwan, where the agents accessed a city’s 119 emergency dispatch system via an unprotected API. They extracted records covering seven districts, including incident times, response types, and street-level locations. Additionally, the agents discovered a Taipei fire department platform that had been exposing patient data since 2018 without requiring a login. This exposed dataset included ECG readings and ambulance video footage. While the attackers scanned many other targets, including military and university systems, they only achieved confirmed data exfiltration in a handful of cases where security controls were notably absent.

Key details

• The attacker is a single individual located in Hualien City, Taiwan, identified through reused digital identities and IP address leaks.
• The BOSSAI framework utilized abliterated local AI models because commercial providers like Grok refused to generate attack code.
• Confirmed breaches included emergency dispatch records in Taipei, patient data from a fire department platform, and phone records in Mexico.
• The attacker’s server contained over 90,000 files, providing a complete view of the operation, tools, and stolen data.
• AI agents generated numerous false positives, with one tool inventing non-existent CVEs and misclassifying more than half of its critical findings.
• Attacks failed against systems enforcing proper authentication, paywalls, or endpoint filtering, highlighting that basic hygiene stops automated threats.

Background

To understand this attack, it is helpful to distinguish between standard commercial AI and abliterated models. Commercial AI services implement strict safety guidelines to prevent users from generating malware or conducting unauthorized access tests. Abliterated models are open-source weights that have been modified to remove these restrictions, allowing them to run locally on private hardware without oversight. This enables bad actors to use powerful language models for malicious scripting and reconnaissance without triggering provider alerts.

The term API, or Application Programming Interface, refers to the methods by which different software components communicate. In this case, the emergency dispatch system had an API that was publicly accessible without adequate authentication. This allowed the AI agents to query the system directly and retrieve structured data. Similarly, the exposure of patient data since 2018 suggests a long-standing failure to secure web-facing applications, a common issue in legacy infrastructure that lacks regular security audits.

Why it matters

For teams that self-host software or manage internal IT infrastructure, this incident underscores the risk of relying on obscurity rather than robust access controls. The attacker succeeded not because of sophisticated zero-day exploits, but because he found doors left wide open. Default credentials on a vendor’s database admin panel and hardcoded encryption keys in front-end JavaScript are basic hygiene failures. As AI lowers the barrier to entry for scanning and exploiting such weaknesses, the volume of automated probes against your infrastructure will likely increase.

Furthermore, the high rate of false positives generated by the AI agents does not mean the threat is negligible. While the tools were imperfect, they were sufficient to identify low-hanging fruit across multiple countries. For IT managers, this means that even noisy, imperfect automated attacks can cause significant damage if your perimeter defenses are weak. The fact that the attacker manually bridged the gap between agents shows that human oversight remains part of the loop, combining AI speed with human intent to bypass simple defenses.

What you can do

• Audit all public-facing APIs to ensure they require authentication and rate limiting, removing any endpoints that do not need external access.
• Scan your codebase for hardcoded secrets, such as API keys or encryption credentials, and move them to secure environment variables or vaults.
• Replace default credentials on all administrative panels and database interfaces immediately, enforcing strong password policies.
• Implement regular patching cycles for all self-hosted services, particularly those running older versions of databases or web servers.
• Monitor domain and certificate expiry dates closely, as expired assets can sometimes lead to subdomain takeovers or trust issues.
• Review logging and alerting configurations to detect unusual scanning patterns or repeated failed login attempts from single sources.