BOSSAI gave one operator a 12-agent offensive mesh, with verified data theft and important autonomy limits

Acronis Threat Research Unit reports one human operator coordinating a mesh called BOSSAI: twelve specialized AI agents, shared operational infrastructure and open-source agentic penetration-testing tools. The campaign targeted hundreds of organizations across eleven countries, but the target count must not be presented as the count compromised. The researchers document a narrower subset of confirmed intrusions and medical or personally identifying data exfiltration, including Taiwan emergency-response organizations and universities in Thailand.

The report exposes a limit usually hidden in summaries of agentic attack campaigns. Commercial hosted models supported infrastructure design and maintenance but refused a range of explicitly offensive tasks. The operator switched to local, safety-modified models, which were less capable and generated operational mistakes. Individual agents could pursue instructions out of context, hallucinate exploitability and skip potential targets. This was an orchestrated network of tools with human direction; the first-party evidence does not support a self-directed campaign running successfully without an operator.

The new pattern is a layered attack mesh: task-specific agents move from external reconnaissance to attempted intrusion to extraction while sharing or receiving instructions from the same principal. Defenders must establish which discoveries were reproduced, which compromises actually yielded data, and whether apparently parallel attacks share common infrastructure. This is distinct from Binance's internal AI-tool pivot and separate from model-only red-team benchmarks.

The mesh was not a single mind issuing uninterrupted commands. Acronis observed a human relaying HalberdStrike scan output into Hermes and then to Cursor for exploitation, while other agents repaired scripts or maintained proxy and messaging infrastructure. The offensive tools ran largely on safety-modified local models because hosted commercial models commonly refused direct hacking requests. Configuration mattered: HalberdStrike scope checks were disabled and all risk tiers were automatically approved, so model-generated commands did not meet an independent authorization gate. Local models also fabricated vulnerability findings and misread failed tests as successful discovery. Acronis confirmed exfiltration in a narrower set of victim systems than the full hundreds-target scan list, and it did not identify a state sponsor. This is evidence of multi-agent operational leverage mixed with manual glue, high noise and unreliable outcomes, not a measured demonstration of end-to-end autonomous compromise of every target.