Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records

Summary: Researchers at Acronis's Threat Research Unit said a single attacker in Hualien City, Taiwan used AI agents to pull emergency dispatch records covering seven Taipei districts from the city's 119 system API, and also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video, without a login. The attacker aimed the agents at hundreds of organizations in at least 11 countries and collected data or accessed systems at about 10 in Taiwan, Mexico and Thailand, with the agents running almost entirely on locally run "abliterated" models after commercial AI models mostly refused to help.
What you should know: The agents succeeded mainly against data that was already poorly protected - a medical data port open since 2018, dispatch records on a public-facing API, a lender with 16 SQL injection points - and failed wherever logins were enforced and endpoints were properly filtered. One person with locally run models stripped of safety training reached hundreds of targets across 11 countries, and the operation was only reconstructed from his own server after 12 days of observation.

Read the original at The Hacker News ↗