One hacker, a dozen AI agents, 11 countries: what two new attacks reveal about AI-powered hacking

This week brought two of the most detailed public accounts yet of attackers using AI agents (software that acts on its own) against real systems. On November 4, the Acronis Threat Research Unit (TRU) published a forensic write-up of "BOSSAI," a campaign it attributes "with high confidence" to one person in Hualien City, Taiwan. According to Acronis, he pointed a set of AI agents at hundreds of organizations in eleven countries. Two days earlier, the documentation host GitBook was breached in what it called an AI-agent-driven intrusion. Its app was offline for about 16 hours.

For companies weighing AI security risk, the lesson is narrower than the headlines. Safety refusals in commercial models slowed a determined attacker but did not stop him, because he could switch to models with their safeguards stripped out. And the attackers got in through the usual weaknesses: exposed services, default credentials and badly configured integrations.

What Acronis actually recovered

The evidence is unusually strong because it comes from the attacker's own records. TRU found an open directory on his main server and recovered more than 90,000 files, about 9GB, including logs, agent conversations, command histories and victim data. Acronis counts 12 agents, nine of them active. Grok, OpenClaw, Claude Code and Codex built infrastructure; Hermes, Cursor, Trae and CyberStrike ran attacks. The busiest, Hermes, logged 18,311 messages across roughly 95 sessions.

The word "mesh" oversells the autonomy. Acronis says plainly that the agents did not talk to each other; the operator pasted output between terminals by hand. Confirmed damage was also far smaller than the targeting. Acronis confirms data theft or system access at about 10 targets in three countries, and active attacks without confirmed compromise on about 15 more. That gap implies most of the "hundreds of organizations" never got past scanning. Cyber Security News, for example, reports the agents found 489 targets across 45 Thai universities but pulled data from only three. The harm was still real. It included a Taipei fire-department patient-care platform exposing ECG readings, ambulance video and vital signs with no login required, plus about 206,800 Mexican residential phone records.

The agents were also unreliable. Acronis says more than half the high-severity and critical findings from HalberdStrike, an automated hacking toolkit in the setup, were false positives or misclassifications. Some models invented vulnerability IDs (CVEs) without evidence. The operator's automated vulnerability platform reported a critical Apache flaw, one letting outsiders run code remotely, at a national disaster-response center. Acronis says it did not exist. Its summary: the operator's ambition outran what the agents could deliver, and on properly configured systems "there was substantially less that the agents could do."

Commercial safeguards held, so the attacker switched models

For AI vendors and policymakers, the key finding is about safeguards. Acronis reports that OpenClaw, running MiniMax M3, refused every offensive request. It once told the operator that "giving commands" does not equal "authorization." Grok 4.5 refused all explicit attack requests but one: fixing a broken proof-of-concept exploit script. It said scanning or penetration-testing work required written authorization. Acronis adds that simple tricks reported to bypass frontier models' safeguards elsewhere, such as claiming to be a pentester, did not work here.

So the attacks ran mainly on "abliterated" models: freely downloadable (open-weight) versions of DeepSeek, GLM and Qwen with their safety training removed. Acronis says even the Claude Code and Codex agents were mostly rerouted, via workaround software, to an abliterated model rather than to Anthropic's or OpenAI's own. Hermes cycled through at least nine models in 19 days, ending on an abliterated DeepSeek-V4 variant running on four of the operator's own GPUs. Acronis says these local models were less effective and resource-constrained. On this evidence, refusals made the attack sloppier rather than preventing it.

Two caveats limit the credit refusals deserve. First, Acronis concedes it is "not clear" how commercial models would have handled a simple forged engagement letter, the cheapest pretext available. Second, lab work suggests open-weight models can do far more than this operator got out of them. In an October 29 study, Epoch AI reported that the open-weight GLM 5.3 built working file-stealing exploits against six of six Firefox releases it tested. The marginal cost was about $1,000 per version at pay-per-use API prices. The researchers say they triggered no safeguards or refusals from any provider. The result has limits. Each exploit relied on a flaw Mozilla patched on October 27. The attacks stopped short of running any code the attacker chose, and similar attempts on Chrome had not succeeded after about $100,000 in API costs. Still, the gap between lab and field suggests this operator was held back more by his skill and tooling than by what open-weight models can do.

GitBook: an AI claim that rests on speed

GitBook's postmortem describes a conventional chain of security failures. The attacker exploited a flaw in its single sign-on (SSO) login to create sessions as GitBook staff. A misconfigured GitHub App led to internal code repositories and a Cloudflare API key. That key exposed live-system credentials and full infrastructure access. GitBook says the attack was aimed at one customer, yet it treated all customer data as potentially exposed. It says it "cannot determine" whether the attacker took any action in customer repositories.

The AI attribution is thinner. The postmortem calls the intrusion "a highly targeted attack using AI agents." But its evidence is inference: the attacker's speed and precision, it says, pointed to an attack "driven largely by automation and AI." GitBook has named no model or tool, as ForkLog also noted, and released no agent logs. One customer, PancakeSwap, moved its docs off GitBook afterward. GitBook says more detailed write-ups will follow "in the coming weeks."

What is proven, and what is not

What is measured: one operator, using off-the-shelf agent software and stripped-down local models, stole real data from poorly secured public-sector and commercial systems. On Acronis's reading of his logs, commercial-model refusals pushed him onto weaker tools. What remains speculative: whether BOSSAI marks a trend or one careless actor. We know of it only because his server was left open, and Acronis itself calls the failure rate of AI agents "severely underreported." GitBook's AI claim is also unconfirmed until it publishes evidence.

The source also warrants care. Acronis sells security products, and we found no independent reproduction of its findings. Its report does not say whether victims or law enforcement were notified. Even so, both cases point the same way. Refusal training in commercial AI services helps, but it cannot be the main defense while anyone can run open-weight models with the safeguards removed. Most protection still comes from basic security: logins on every exposed service, regularly rotated keys, and integrations limited to the access they need.