Acronis traces AI-assisted data theft to one operator using specialized agents

One operator used specialized AI agents to target hundreds of organizations across 11 countries, with confirmed data theft at universities and emergency-services providers, according to a November 4 investigation by Acronis. Yet the operation was not a self-running AI team: the human copied information between agents, while model refusals and mistakes complicated the attacks.

Acronis Threat Research Unit calls the operation BOSSAI and attributes it to a single Taiwan-based operator. Its targets included government emergency services, banks, universities, military systems, online stores and gambling sites. The hundreds of organizations were targets, not a confirmed breach count. Researchers specifically identified successful intrusions at universities and emergency-services providers, with medical records and personally identifiable information stolen.

Researchers discovered the operation through what first looked like a misconfigured development environment. They examined more than 90,000 files totaling about 9GB, including agent conversations, command histories, attack tools, credentials and victim data. That exposed not just the attack machinery but records of the operator directing it.

Twelve agents, one human bridge

BOSSAI contained 12 configured agents, but only nine were active when investigators examined it. Their jobs differed. Some built and maintained infrastructure, including domain settings, proxies and messaging-app connections. Others scanned targets, developed exploits or produced security reports. The boundaries overlapped, but the agents were not simply copies performing the same task.

The operator issued commands mainly in Traditional Chinese, sometimes supplying only a target address. In other cases, the instructions included reconnaissance results or vulnerability scans. Two agents had messaging-app connections: a WeChat gateway reached Hermes, an offensive agent, while OpenClaw connected to LINE and primarily handled infrastructure tasks.

The agents used penetration-testing software—tools for finding and testing security weaknesses. Model Context Protocol, or MCP, servers connected them to those tools. The setup loaded as many as 13 such servers; investigators later found it reduced to three: HexStrike AI, a Kali Linux server and a Ghidra analysis bridge. Agents could invoke the connected tools autonomously.

Refusals changed the attacker's model choices

Commercial models helped build and maintain BOSSAI's infrastructure, but Acronis says they repeatedly refused requests to identify or exploit vulnerabilities. Multiple models asked for proof that the work was authorized, then declined when the operator supplied none. Chinese commercial open-source models also rejected hacking instructions, according to the investigation.

Those refusals pushed offensive work toward locally run models modified to remove safety restrictions. Acronis describes them as less effective and constrained by computing resources. Local models ran on a server using RTX 4090 graphics cards, supplemented by rented GPU capacity as the operator sought enough memory for larger models.

The safeguard findings have a specific limit: the operator did not provide proof of authorization. Acronis leaves open how the models might have responded to a fabricated engagement letter. The observed refusals therefore show resistance in this campaign, not that every possible attempt to bypass the controls would fail.

More activity did not mean reliable judgment

Broad discretion created its own problems. Researchers recorded agents failing, hallucinating and producing more information than the operator could readily handle. Agents were told not to bother the operator; in one instance, an agent passed over a Honduran military target because it judged it outside the assigned scope.

Acronis has not established a specific affiliation or a single political, financial or ideological objective for the operator. The mix of targets spans activity resembling espionage and opportunistic cybercrime. The investigation identifies a coordinated operation, but its breadth alone does not establish who ultimately benefited or why those organizations were selected.