BOSSAI AI Agents: Taipei Emergency Dispatch Records Pulled in a One-Operator Campaign, What Is Confirmed and What to Check

A security research team says one person used a group of AI agents to pull emergency dispatch records covering seven Taipei districts while probing hundreds of other organizations. It matters to your business because the agents mostly succeeded through old, ordinary gaps such as default passwords, exposed services and unpatched databases, and those gaps exist on company networks everywhere.

The findings come from the Acronis Threat Research Unit, in a report dated November 4, 2026. Everything here rests on that one report. We found no public response from Taipei's fire department or Taiwan's government.

What is BOSSAI?

BOSSAI is the name of a network of 12 AI agents, nine active and three set up but unused. Some built and maintained infrastructure, while others scanned and attacked targets. The agents did not talk to each other directly: Acronis describes the operator as the center of the mesh, acting as a bridge between them.

Researchers came across it through what first looked like a misconfigured development environment. Acronis says its analysis covers more than 90,000 files totaling 9GB, and that it observed the setup for 12 days.

What happened in the Taipei emergency dispatch breach?

Across the campaign, Acronis says it confirmed data theft or system access at roughly 10 distinct targets in three countries: Taiwan, Mexico and Thailand. About 15 more were attacked without confirmed compromise.

What is confirmed and what is not known about BOSSAI

Confirmed here means confirmed by Acronis from the evidence it reviewed. We could not find a victim or government agency verifying these details.

• Who did it: Acronis assesses "with high confidence" that one individual based in Hualien City, Taiwan, ran the operation. That is a researcher's assessment, not a court finding.
• How many countries: The report's summary says eleven. Its body names about 15 locations once places that were only scanned or queued are counted, and it does not reconcile the two figures. Treat eleven as the report's headline number, not a settled count.
• Patient data: The summary cites confirmed theft of medical data at emergency services providers. The detailed section says only that the platform was found exposed, and it does not say whether that platform is connected to the dispatch system.
• Motive: Acronis says it is unclear, and presumes the goal was to make money from access.
• Not stated: The report does not say whether victims or authorities were notified, or whether the exposed data can still be reached.

Did AI tools refuse to help the hacker?

Some did. Acronis reports that Grok 4.5 and MiniMax M3 refused explicit attack requests. On July 25, 2026, the operator asked Grok to port a Hikvision camera exploit tool to Linux, and Grok refused. Grok made one exception, fixing a broken proof-of-concept script.

The operator worked around those refusals. The offensive agents ran on stripped-down versions of DeepSeek, GLM and Qwen with safety alignment removed, often called abliterated models. These ran on the operator's own GPU machine, supplemented by rented GPU capacity that came and went as the operator chased memory for larger models. Acronis also describes shims that intercepted API calls from Claude Code and Codex and routed them to the same abliterated model, mostly for infrastructure work.

The lesson for defenders is that a refusal inside one AI product does not stop someone willing to swap the model underneath.

How well did the AI agents actually work?

Less well than the headline suggests. For one scanning tool, Acronis says over half of the high-severity and critical findings were false positives or misclassifications. The agents invented the Apache flaw listed in the table and wrote it up as a confident, structured report.

Acronis says the agents failed where authentication was enforced, where paywalls required valid sessions and where endpoints were properly filtered. It also says risk clustered around data that was already weakly protected.

Why AI agent attacks matter for a company network or website

The change is in cost and reach. One operator could look at hundreds of organizations at once, so being obscure no longer protects a forgotten server. The test portal nobody remembers, the vendor admin panel and the database exposed since a past project are all findings waiting for a scanner. If you are unsure what is visible from the internet, start with whether your website is locked down.

Vendors matter just as much. One of the clearest wins in this report was a default root login at a technology supplier to fire departments. If a vendor runs software on your behalf, ask who is patching it.

This case was an attacker running their own agents, not a company's AI assistant being hijacked. If your business is deploying agents, that is a separate risk. The OWASP Top 10 for Agentic Applications, published December 9, 2025, is a practical starting point, and our piece on who keeps AI-built apps running covers the upkeep side.

What to do this week

Acronis does not publish a recommendations list, so this checklist is ours, drawn from what worked and failed in its report.

BOSSAI AI agent attack questions people are asking

Was Taipei's 119 emergency system hacked by AI?

Acronis says AI agents pulled case records covering seven Taipei districts from a city's 119 dispatch system through a public-facing API. It does not explain exactly how that access was obtained.

Could the attacker track ambulances live?

Acronis says no. The records are case data with street-level locations, not real-time GPS tracking.

Was patient data stolen in Taipei?

It is not fully clear. The platform was found exposing ECG readings, ambulance video and vital signs from 2018 without credentials. The report's summary cites medical data theft, but its detailed section only describes the exposure.

Who is behind BOSSAI?

Acronis assesses with high confidence that it was one person based in Hualien City, Taiwan. It says any affiliation is unclear.

How many countries did BOSSAI target?

The summary says eleven, while the body names about 15 locations. Confirmed access or data theft was limited to Taiwan, Mexico and Thailand.

Can AI agents hack a business on their own?

Not in this case. A person directed the work and carried output between agents, and the agents made serious errors. They still found real weaknesses quickly.

The bigger lesson

AI made it cheaper to find weak systems at scale, but it did not get through the defenses that held. Logins that are enforced, default passwords that are gone and old services that are switched off remain the work that decides who gets hit.

For help closing these gaps, see our security hardening service or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Acronis Threat Research Unit, BOSSAI report; OWASP Top 10 for Agentic Applications for 2026; CISA Secure by Design Alert on default passwords.