Acronis Threat Research Unit (TRU) has uncovered BOSSAI, an AI-driven campaign run by a lone operator based in Taiwan. The operator built a mesh of 12 AI agents that together handled infrastructure and attacks. According to Acronis, hundreds of organizations in eleven countries were targeted.
Targets included emergency services, banks and lenders, universities, military systems and e-commerce platforms. Confirmed breaches at universities and emergency services providers led to the exfiltration of medical data and PII.
AI-powered offense has its limits, though. Commercial models and Chinese open-source models repeatedly refused to help with vulnerability identification or exploitation, so the operator turned to less effective local abliterated models.
Excessive autonomy backfired as well. Agents that were told not to bother the operator passed over a Honduran military base because they deemed it out of scope. Acronis also notes that the agents created volume and often mistakes, which complicated the attacker’s work.
Acronis calls this an AI-augmented threat. For your organization, expect faster, more automated attacks from small actors, and review your exposure accordingly. Acronis also warns about unmonitored abliterated models running with excessive autonomy.
Read acronis.com article for more information.
