Observed incident

BOSSAI agents extract emergency-dispatch and university records

Reported

Published here

What happened

Acronis found evidence of access or data extraction at about ten targets across three countries. The operator used AI agents to pull Taipei dispatch records and extract data from Thai university databases.

Parties and reporting

AI tools and systems: BOSSAI, Hermes, HalberdStrike, Cursor, Locally hosted DeepSeek models

Outcome

Acronis reconstructed 12 days of activity from exposed attacker infrastructure. It distinguished confirmed access from unsuccessful exploitation, scans and targets queued for later. Victim remediation is undisclosed.

Operating lesson

Require authentication on emergency-data APIs, test legacy applications for SQL injection and alert on bulk reads of patient or student records.

Evidence and limits

Acronis assesses one operator directed the mesh. Nine of 12 configured agents were active and the operator relayed results between them. Some findings were fabricated by the agents. Scanned or staged targets do not establish compromise.

Sources