A single hacker has used a 12-agent AI attack mesh to target organizations in 11 countries and transform cyber threat operations.

The team of AI agents, collectively called BOSSAI by the Acronis Threat Research Unit (TRU), targeted hundreds of organizations spanning government emergency services, banks and lenders, universities, military systems, phone directories, e-commerce platforms, and gambling sites in eleven countries.

To the researchers, the campaign proves that now, a single individual can do what once needed a full team.

It isn’t clear whether the attacker has any specific affiliation or goal beyond compromising as many organizations as possible, presumably to monetize the activity.

But the campaign seems especially sophisticated. Each of the 12 AI agents is fulfilling separate roles but “working together to achieve compromise and making use of open source, agentic pentesting platforms,” Acronis TRU said.

AI-augmented threat

Quite a few breaches, related to the BOSSAI campaign, have already been confirmed at universities and emergency services providers. Medical and personal data have been exfiltrated, Acronis said.

The cybersecurity company detected the campaign after discovering what appeared to be a misconfigured development server. It was a full attack platform with more than 90,000 files, about 9GB of logs, chat histories, exploit tools, and victim data.

The researchers’ conclusion is that one individual – they say they’re a Taiwanese operator – with rented GPUs and open-source tools can now run a campaign that previously needed a full team.

Essentially, Acronis TRU says, the activity looks like a state-backed group but comes from one person – and can be called an AI-augmented threat.

Some of the agents wrote code, others scanned websites, and yet another group of them carried out the attacks. They didn’t interact with each other – the operator sat in the middle, aligning the agents’ work.

“This individual built the kind of system many professionals strive to build in their day-to-day jobs: a complex system of AI agents, using various harnesses and MCP servers, working together to achieve a specific goal,” said the researchers.

“Only in this case, the goal was not a more organized calendar but persistent espionage campaigns, using all the necessary tools, and with the same speed of attack demonstrated across Anthropic’s reports of multiple threat clusters operating globally.”

Commercial models resisted instructions

In Taiwan, for instance, a Taipei fire-department patient-care platform exposed ECG readings, ambulance video, and vital signs from 2018. The BOSSAI mesh also pulled case records from Taipei’s emergency services dispatch system.

The AI agents also collected about 206,800 residential phone records in Mexico. In Thailand, they found 489 targets across 45 universities and pulled data from three of them.

The good news is that, while the BOSSAI mesh used commercial models for building infrastructure, these models repeatedly refused to engage in actual offensive activity.

Though willing to “aid and abet” in various ways, every prompt aimed at identifying or exploiting vulnerability was met with resistance. Chinese commercial open-source models also refused hacking instructions and even lectured the operator on cyber laws.

As a result, the hacker was forced to turn to locally run open-weight models, which were less effective and resource-constrained. Agents made a lot of mistakes, complicating the attacker’s work, Acronis TRU said.