Lone attacker's AI agents pulled Taipei dispatch records
Acronis researchers say one Taiwan-based attacker ran AI agents against hundreds of targets in 11 countries, reaching Taipei emergency dispatch records.
Morgan "airgap" ReyesConfirmed: a single attacker used AI agents to pull emergency dispatch records covering seven Taipei districts. Researchers at Acronis’s Threat Research Unit said so last week, per The Hacker News report of November 9, 2026.
Attribution and evidence
The researchers are highly confident the attacker is one person based in Hualien City, Taiwan. The evidence came from the attacker’s own server. It first looked like a misconfigured development system. It was the operational platform: more than 90,000 files, including agent conversations, command history, tools, credentials and victim data. The researchers watched the operation for 12 days.
Scope
The attacker aimed the agents at hundreds of organizations in at least 11 countries. Targets included emergency services, banks, universities and military systems. Data was collected or systems accessed at about 10 organizations in Taiwan, Mexico and Thailand.
- Taipei 119 dispatch system: records pulled from the system’s API. They hold incident times, response types, case status and street-level locations. They are case records, not live ambulance tracking.
- Taipei fire department platform: exposed 2018 patient data, including ECG readings and ambulance video, with no login. The researchers’ detailed account says the records were exposed. Their summary describes theft of medical and personal data. The two differ.
- Fire-dispatch technology vendor: database admin panel reached with default root credentials. Access to 18 or more tables. A web shell attempt through a known CVE failed.
- Emergency management information system: a hardcoded key in front-end JavaScript exposed session-cookie contents. No confirmed compromise.
- National disaster-response center: a scanner reported a critical Apache remote code execution flaw. The flaw did not exist.
- National fire agency SSO portal: login guessing. No confirmed access.
- Fire-department systems in five cities: scanned for software fingerprints. No confirmed compromise.
- Taiwanese lending firm: account table taken through SQL injection.
- Thailand: data collected from three universities the same way, after 489 candidate targets across 45 institutions were selected.
- Mexico: about 206,800 home phone records with names and addresses, built from government statistics, postal code lists and telecom authority data.
About 15 more organizations were attacked without a confirmed break-in. In at least eight other countries, targets were scanned or queued but not yet attacked when the researchers looked.
How the AI was used
The setup, called BOSSAI, had 12 agents, 9 in use. The agents did not talk to each other. The attacker pasted one agent’s output into another by hand. Commercial AI models mostly refused to help, so the attacking agents ran almost entirely on “abliterated” models: locally run models with safety training removed.
Unconfirmed
The report does not say whether the affected organizations or Taiwan’s authorities were notified, or whether the exposed data is still reachable. Treat both as unknown.
Analysis: the failures listed above (a phantom Apache flaw, no confirmed access at most targets) show the agents were noisy and error-prone. The successes came from default credentials, exposed endpoints and SQL injection, not new techniques. Confidence: moderate, based on one secondary report of the researchers’ findings.
For related coverage, see the threat intelligence hub and the NCSC warning on AI-driven attacks against UK infrastructure.
Found this useful? Share it.
