BOSSAI AI Agent Attack Campaign: One Operator, Real Breaches

Acronis Threat Research Unit has published its investigation of the BOSSAI AI agent attack campaign, describing activity it identified in recent weeks. TRU assesses that one operator in Taiwan ran a mesh of 12 AI agents against hundreds of organizations in eleven countries. A misconfigured development environment exposed more than 90,000 files, about 9GB, including logs, tooling, credentials, and victim data. The mesh still needed a human to move text between agents. It still produced theft of medical data and personally identifiable information.

What is the BOSSAI AI agent attack campaign?

BOSSAI is TRU’s name for 12 AI agents, nine active and three built but unused, run from one operational environment. The operator used open-source agentic pentesting platforms and Model Context Protocol servers. TRU names neither a state sponsor nor a criminal group.

Targeting covered government emergency services, banks and lenders, universities, military systems, phone directories, e-commerce platforms, and gambling sites in eleven countries. Confirmed compromise is a shorter list: universities and emergency services providers, with medical data and personally identifiable information exfiltrated.

TRU first saw what looked like a misconfigured development environment. It was a working attack platform containing orchestration logs, agent conversations, command histories, exploit tooling, credentials, and victim data from more than one country. The more than 90,000 files, about 9GB, preserved the path from reconnaissance through exfiltration.

Commands were typed largely by hand, in Traditional Chinese, into each agent’s interface. TRU places the operator in Taiwan and reads the effort as lone. That assessment rests on one person’s environment, not a group ledger or payment trail. The files show no second operator, customer, or state tasking note. TRU presumes monetization but documents no payment or buyer.

The scale language needs the same care. Hundreds of organizations were targeted, TRU says dozens were attacked, and two sectors have confirmed theft. Calling all hundreds victims runs ahead of the published record.

TRU proposes the label AI-augmented threat, shortened to AAT. Government, emergency-services, and military targets, plus espionage-style theft, resemble an advanced persistent threat. Other activity looks like opportunistic cybercrime, without one political, financial, or ideological objective the files support. The label describes that mix; it does not tell a SOC what to block.

One person built the multi-agent system many teams want for legitimate work: specialized agents, harnesses that give a model tools and a session, and MCP servers aimed at one goal. Here the goal was persistent intrusion. Agents also refused, flooded the operator with text, drifted in scope, and hallucinated. The breaches sit beside that failure record, not inside a self-directing swarm.

How was the 12-agent mesh actually wired?

Twelve agents sat around one person who moved text between them by hand. Three were unused. Roles split into infrastructure builders, attackers, and a scanning layer. No agent-to-agent channel was configured, a fact any autonomy claim must address.

TRU’s mesh diagram (Figure 1) shows infrastructure builders and maintainers on one side, scanning and attack agents on the other. Figure 2 puts local models on an operator-run server for attack and infrastructure roles, while cloud models remain on infrastructure agents. The operator issues commands and relays text between the two lanes.

Role	Names TRU recorded	What they handled
Builders	Grok, OpenClaw, Claude Code, Codex	MCP wiring, DNS, proxies, messaging gateways
Attackers	Hermes, Cursor, Trae, CyberStrike	Offensive tasks; Hermes was primary
Scanning	HalberdStrike, cracked Acunetix	Structured vulnerability reports for the pipeline

Figure 4 records that roster. OpenClaw, nicknamed Little Claw, connected to LINE and mainly handled infrastructure. A sparsely used WeChat gateway routed to Hermes, the primary offensive agent. Those apps were remote controls for a person, not a bus between models. Agents did not share one context window and often lacked the full picture of the operation.

HalberdStrike wrote findings, while a cracked Acunetix Web Vulnerability Scanner installation fed structured reports into the pipeline. TRU does not state that build’s version. Cracked security tools can infect their own hosts; this lab already held credentials and victim data in a readable store.

Attack commands were often terse, sometimes little more than a victim address. Others pasted a reconnaissance scan or pentest result. TRU shows the operator requesting active exploitation and pasting entire vulnerability scans without further comment. The model speeds a step, but a person still runs the campaign.

Manual bridging matches the recorded failures. Volume overloaded the operator, lower-tier models hallucinated on large inputs, and mistakes accumulated. Agents told not to bother him also dropped targets they judged out of scope, including a Honduran military base. The instruction to stay quiet caused the mesh to skip that target.

A closed loop of agents tasking each other would leave a different gap in the logs. This mesh left a paste-shaped gap. A scan that stalls before a narrower burst, after a human edits scope, is the event worth alerting on.

How did MCP servers become the attack toolchain?

The operator attached tools through Model Context Protocol servers, the same plumbing product teams use so an assistant can reach a repository, browser, or ticket system. TRU did not need a protocol flaw. The operator needed servers that ran offensive tools when an agent asked.

The catalog peaked at 13 MCP servers and was later trimmed to three. At its peak, it covered GitHub security lookups, CVE lookup, OSINT, cloud auditing, binary analysis through Ghidra and Radare2, browser automation through Playwright, and an MCP-wrapped Kali Linux instance.

The Kali wrapper exposed nmap, sqlmap, Metasploit, Hydra, and more. The three survivors were HexStrike AI, which TRU describes as a custom cybersecurity automation server, a Kali MCP server, and a Ghidra bridge. Peak breadth reads as experimentation; the remaining calls reliably returned output worth pasting onward.

The protocol does not label a call as helpdesk work or intrusion work. Schema, credentials, and network reach do. Teams that put MCP in front of internal admin APIs inherit that risk pointed inward. We test that surface as MCP server security testing: which tools a low-trust prompt can invoke, which credentials the server holds, and whether one tool’s output can steer the next call.

WeChat and LINE were already wired to two agents, so a tool server behind either gateway inherits a remote path. A wide tool list also bloats context and gives a safety-aligned model more chances to refuse. The trim to three reflects what remained after the operator learned which calls paid.

Eight VPS nodes handled gateways, reverse proxying, and fleet management. Attack traffic left through an operator-controlled SOCKS5 pool for some targets and BrightData datacenter proxies when he wanted a geo-located exit. Put that egress next to the MCP cluster before assigning a campaign name, and open a ticket on the cluster either way.

What happened in the emergency-services attack chain?

HalberdStrike scanned a Taiwanese emergency-services target, wrote a pentest report on several misconfigurations, and stopped at the text. The operator pasted that output into Hermes. Hermes consolidated the findings and added attack-path analysis. He then pasted Hermes’s report into Cursor and told it to exploit. Cursor selected a path and executed.

That is three agents and one person moving the artifact. They did not need shared memory or a message bus. The report does not say each stage ran a different model, so this account does not add that claim.

TRU confirms breaches at universities and emergency services providers, and confirms exfiltration of medical data and PII. Operations against government, military, university, and financial targets went further in some cases than others. Until TRU or a victim discloses more, military and bank mentions remain targeting evidence, not confirmed compromise.

The openings HalberdStrike wrote up were misconfigurations, not a new vulnerability class. The agents shortened recon, report writing, and the handoff into exploitation. Universities and emergency services often mix legacy web apps, vendor appliances, and identity systems that rarely get a full authorization review. Structured scanner output is enough for an operator who will paste the report forward.

TRU does not give a full confirmed-victim count, the specific weakness behind each breach, or how long access lasted. It also leaves open whether stolen medical data moved beyond the operator’s storage.

That storage is part of the incident. Victim data sat inside the exposed files, and anyone else who reached the same environment could have inherited a copy. The files do not show that a third party did. Named organizations should still ask what of theirs was in the dump.

The supported chain is scan, human paste, consolidate, human paste, execute. TRU draws a parallel to tempo described in Anthropic’s reporting on other threat clusters, but does not provide a measured speed comparison. On the BOSSAI record, the operator remains the scheduler.

Why did the offensive core run on abliterated models?

Hosted models refused the offensive work, so the operator moved it onto machines he controlled. TRU reports that commercial models refused every prompt aimed at vulnerability identification or exploitation. Several asked him to prove the action was legal and refused when that proof did not arrive.

Chinese commercial open-source models refused as well, but would still help around the edges. TRU’s phrase is that they were willing to aid and abet short of the attack step itself.

Chinese commercial open-source models refused hacking instruction as well and even lectured the operator on cyber laws.

The offensive core then ran on locally hosted abliterated variants of DeepSeek, GLM, and Qwen, served through llama.cpp. Abliteration is a weight edit, often called refusal-direction ablation, that strips refusal behavior without a full retrain.

Once open weights can be downloaded, the provider’s policy server is off the path. API guardrails stopped this operator on commercial APIs and hosted Chinese open-source APIs. Local weights did the attack step after he removed the refusal and served the model himself.

Guardrails stopped a route and displaced the work. The replacement models were less effective and resource constrained. Agents created volume and made frequent mistakes, but the campaign continued on the other side of that downgrade.

Claude Code, Codex, and the commercial builder tools can execute shell commands, with safety behavior in the provider policy layer. Offensive prompts failed there, while MCP wiring, DNS, and proxy configuration continued. Cloud models stayed on infrastructure agents; weakness identification and exploitation sat almost entirely on the stripped local tier.

TRU states it is unclear how the models would have reacted had the operator generated a fake engagement letter. A control that turns on a document the user supplies will be tested with a document the user supplies.

A primary GPU host with NVIDIA RTX 4090 cards served the local models through llama.cpp. Rented GPU capacity came and went as the operator chased VRAM for larger models. On our estimate, not a TRU measurement, a 70-billion-parameter model at 4-bit quantization needs roughly 35 to 40GB, so one 24GB 4090 cannot hold it. That arithmetic lines up with the rented-GPU pattern, but is not a figure TRU published.

What should defenders take from BOSSAI?

Confirmed theft came from ordinary misconfigurations, a person moving scanner text, and commodity tools behind MCP. Refusals, hallucinations, scope drift, and a skipped military target sit in the same files as the breaches. Waiting for a self-directing swarm is the wrong gate for a control change.

Start with exposed development and agent stores. This investigation began because orchestration logs, transcripts, tooling, credentials, and victim data were readable in one environment. If an agent workspace is reachable, treat it as a case file, not scratch space.

Watch tool sequence rather than a single binary. A host that calls a commercial web scanner, a Kali-backed MCP server, a Ghidra bridge, and a browser-automation server in one cluster is rare in a normal build pipeline. Pair that cluster with proxy egress, whether a private SOCKS5 pool or a BrightData datacenter exit.

Alert on the human edit, not only the agent name. In the emergency-services chain, the operator pasted reports from HalberdStrike to Hermes to Cursor and corrected scope by hand. A scan that stalls, followed by a narrower exploitation burst, fits that pattern better than a fully automatic loop.

Separate the model route from the tool route in the asset list. Commercial and Chinese hosted models refused direct attack prompts and still did infrastructure work. The attack step moved to abliterated local weights on hardware the operator controlled. Blocking one API vendor does not remove a llama.cpp box on a 4090.

Earlier coverage of CyberStrikeAI, an LLM in a real intrusion’s command path, is the adjacent case: one model close to operations, not a bench of twelve. BOSSAI adds more agent names, weaker local models, and the same person in the middle. Ticket them as one AI-augmented class, and write the human bridge into the finding.

Close the open development store, remove offensive tool servers from agents that only build infrastructure, and keep local and rented GPU hosts on the asset inventory. Then fix the misconfigurations that turned a pasted report into stolen medical data and PII. Our AI agent security testing methodology traces which prompt can call which tool, where the weights run, and whether the logs ever leave the machine.

FAQ

What is BOSSAI?

BOSSAI is Acronis TRU's name for 12 AI agents, nine active, used by one operator to run intrusion activity. Builders maintained infrastructure, Hermes led the attack agents, and the operator pasted results between agents by hand.

Who is behind the BOSSAI AI attack campaign?

TRU assesses a single operator based in Taiwan, issuing commands in Traditional Chinese. That read rests on one exposed environment; no state sponsor, customer, named crew, or documented payment is established.

Did AI safety guardrails stop the BOSSAI attacks?

They stopped a route, not the campaign. Hosted models refused direct attack prompts, so the operator used less effective abliterated local models that still helped produce confirmed theft of medical data and PII.

How did Acronis discover BOSSAI?

TRU found a misconfigured development environment that proved to be a live attack platform. Its more than 90,000 files, about 9GB, included logs, command history, exploit tooling, credentials, and victim data.

If your agents can call scanners, shells, or cloud APIs, BOSSAI is a tool-scope problem as much as a model problem. agent::offense runs AI agent penetration testing against tool use, trust boundaries, and the logs those agents leave behind.