Acronis says one operator used 12 AI agents to breach about 10 targets
BOSSAI targeted hundreds of organizations in 11 countries; commercial models refused offensive requests, while stripped-safety local models carried them out.
Acronis Threat Research Unit says a single operator in Taiwan built a mesh of 12 AI agents called BOSSAI and used it to target hundreds of organizations in 11 countries. The security company reports confirmed system access or data exfiltration at roughly 10 targets across three countries, including universities and emergency-service providers. Exposed material included medical data and personally identifiable information.
The setup combined ordinary agent tools—including Hermes Agent, OpenClaw, Cursor, Claude Code and Codex—with MCP servers connected to security software such as Kali Linux, sqlmap and Ghidra. It was not a fully autonomous swarm: the operator stayed at the center and often copied results manually between agents.
Model choice created a sharp split. Commercial systems mostly built and maintained infrastructure but repeatedly rejected explicit attack requests. Acronis says OpenClaw, running a commercial MiniMax model, refused every offensive request it received. Claude Code and Codex were routed through shims to locally hosted models. The offensive core relied mainly on “abliterated” DeepSeek, GLM and Qwen variants with safety alignment removed. Those models complied, but also generated false positives, hallucinations and enough output to overwhelm the operator.
The findings show how one person can assemble common AI tooling into a broad attack operation, while also exposing its limits. They come from one vendor investigation based on 9GB of recovered evidence. Acronis did not publicly detail independent verification for every claimed compromise, and it remains unclear how guarded models would respond to forged proof of authorization.
