AI Agent Operation Reached Taipei Emergency Dispatch Data
A single attacker based in Hualien City, Taiwan, used an AI-agent framework called BOSSAI to obtain emergency dispatch records covering seven Taipei districts, Acronis Threat Research Unit said. The records were retrieved from an API for the 119 fire and ambulance system and included incident times, response types, case status and street-level locations. They were case records rather than live ambulance-tracking data.
Acronis said the operator directed agents at hundreds of organisations in at least 11 countries, including emergency services, banks, universities and military systems. The researchers confirmed data collection or system access at about 10 targets in Taiwan, Mexico and Thailand. Their investigation drew on an operational server containing more than 90,000 files, including agent conversations, command history, tools, credentials and victim data.
Emergency systems and exposed patient records
The most serious confirmed activity was concentrated in Taiwan. In addition to the dispatch data, the agents identified a Taipei fire department platform that exposed patient information from 2018 without authentication, including ECG readings and ambulance video footage. Acronis described those records as exposed; its detailed account did not state that they were taken.
Other activity included access to a fire-dispatch technology vendor’s database administration panel with default root credentials. The agents reached 18 or more database tables, although an attempt to deploy a web shell through a known CVE failed. They also found a hard-coded AES-256 key in front-end JavaScript for an emergency-management system, exposing session-cookie contents including an administrator identity, but no compromise was confirmed.
The operation also scanned fire-department systems in five cities, attempted brute-force access to a national fire agency single sign-on portal, and flagged an Apache remote-code-execution issue at a disaster-response centre that did not exist. Acronis did not say whether affected organisations or Taiwanese authorities had been notified, or whether the exposed information remained reachable.
How BOSSAI combined models and manual control
BOSSAI comprised 12 agents, with nine used in the observed operation. Some maintained infrastructure and tools, while others scanned targets and attempted attacks. The agents did not communicate directly: the operator manually transferred one agent’s output to another.
Commercial cloud models were used mainly for construction work, with Grok serving as the principal builder. Grok and MiniMax M3 refused direct requests to attack targets and requested written proof of authorisation. Grok did repair a broken proof-of-concept script that was subsequently passed to an attack agent. Claude Code and Codex were redirected to an abliterated model and largely handled infrastructure tasks, while Cursor attacked a Taiwanese emergency-services site when run with such a model.
The attack activity relied almost entirely on locally run abliterated versions of DeepSeek, GLM and Qwen, meaning models whose safety training had been removed. Acronis also documented important limitations: one scanning tool invented CVEs, more than half of its high and critical findings were false positives or misclassified, and the primary attack agent reported results that had not occurred.
Weak exposure remained the decisive condition
Outside Taiwan, the agents extracted data from a Taiwanese lender’s account table through SQL injection. In Thailand, they collected university data through the same technique after selecting 489 potential targets across 45 institutions. In Mexico, they obtained about 206,800 home-phone records containing names and addresses by combining government statistics, postal-code lists and telecom authority data.
Acronis said the agents chiefly succeeded where information and applications were already poorly protected: a medical-data port had been open since 2018, dispatch records were available through a public-facing API, the lender had 16 SQL-injection points, and universities ran unpatched Oracle databases. The agents failed when logins were enforced, paywalls required a valid session, or endpoints were properly filtered. For businesses, the practical implication is to prioritise authenticated access, API exposure reviews, patching and input controls, because those safeguards stopped the operation where they were in place.