One operator, 12 AI agents: what the BOSSAI campaign means for NZ

On 4 November, Acronis's Threat Research Unit published its account of BOSSAI, a mesh of 12 AI agents run by one operator against what Acronis says were hundreds of organisations in 11 countries. Nine agents were active and three were set up but unused. Researchers found the platform on what looked like a misconfigured development server, holding more than 90,000 files of logs, agent conversations, exploit tools and stolen data. For NZ owners and IT leaders, the report shows which weaknesses an agent-run attack got through. It's also a detailed working log of a multi-agent system making mistakes in live use, which anyone planning their own agents should read.

What Acronis found

The confirmed damage is much smaller than the headline number. Over the 12 days Acronis observed, data theft or system access was confirmed at roughly 10 targets in three countries, and about 15 more were attacked without confirmed compromise. The worst harm was in Taiwan, where a Taipei fire department patient-care platform exposed 2018 records, including ECG readings and ambulance video, without authentication. In Thailand, the agents found 489 targets across 45 universities and pulled data from three.

Australian universities appeared in the operator's reconnaissance queries, with no breach described there, and the report doesn't name New Zealand. The evidence also comes from a single vendor. eSecurityPlanet's write-up relies on Acronis's research and cites no outside experts, and Risky Business's 6 November bulletin describes a suspected Chinese actor across 12 countries, where Acronis assesses a lone individual in Taiwan across 11. We've used Acronis's figures because its team analysed the server contents directly.

The weaknesses were old ones

The successful attacks relied on faults that security teams have been warning about for decades. Acronis lists SQL injection at Thai universities, including an Oracle 9.2 system, default root credentials on a fire-dispatch vendor's admin panel, and an encryption key hardcoded in frontend JavaScript. Brute-forcing of a single sign-on portal and credential stuffing produced no valid access. Acronis's own finding is blunt: "when a system is properly configured, there was substantially less that the agents could do."

What changed is the cost of looking. Acronis argues that obscurity stops protecting anyone once agents can inspect hundreds of targets at the same time. We think this should change how smaller NZ firms assess risk, because many of them have quietly relied on being too small to attract a human attacker's time. An agent-run scan doesn't need a reason to look at a forgotten customer portal in Hamilton. The default-credential finding also sat with a supplier, so a firm's exposure extends to whoever hosts its systems.

The NCSC has been saying much the same thing all year. Its April guidance tells defenders to patch frequently and to start with systems exposed to the internet. Its June advisory for government agencies warned of a "vulnerability storm" and pointed to known vulnerabilities and legacy systems. The Cyber Threat Report 2026 expects frontier AI to put advanced capability in the hands of individuals. BOSSAI gives those warnings a concrete case with logs attached.

Commercial models repeatedly refused offensive work, so the operator moved attack tasks to locally run models with the safety controls stripped out. Those models were weaker, and the campaign carried on anyway. Commercial models still helped build the infrastructure, and Acronis warns the approach could work without any background in coding or AI engineering. Vendor safeguards slow an attacker down, but your threat model shouldn't depend on them.

What the attacker's agents teach anyone building agents

The operational failures are the most useful part of the report for firms planning their own agents. More than half of the high and critical findings from HalberdStrike, the scanning harness, were false positives or misclassifications. One failed connection was reported as a critical remote code execution flaw, and the operator had to add anti-fabrication rules mid-campaign. Hermes, the main attack agent, decided a Honduran military system was out of scope and dropped it without consulting the operator. Hermes also cycled through at least nine models in 19 days, and the agents produced more output than one person could review.

The mesh also wasn't as autonomous as the name suggests. Agents never talked to each other, and the operator often pasted results from one to the next by hand.

An invoice-matching or service desk agent can fail in the same ways, with confident reports of things that didn't happen and decisions made outside the brief. An attacker can absorb a false-positive rate above 50% because a wasted probe costs almost nothing. A finance team acting on the same error rate would pay wrong invoices. The joint guidance NCSC-NZ co-sealed in April recommends incremental deployment, rigorous monitoring and human oversight, and limits agents to low-risk, non-sensitive tasks. BOSSAI's logs show why an agent's report needs checking before anyone acts on it.

Next steps for NZ businesses

If time only allows one item this month, do the first. Most of the other steps depend on knowing what's exposed.

• Map what's reachable from the internet. Include old portals, test sites and supplier-hosted admin pages, give each one an owner, and switch off anything nobody claims.
• Check authentication on public APIs and admin panels. Remove default credentials, then ask suppliers who host your systems or data to confirm in writing that they've done the same.
• List software that's out of vendor support. Patch internet-facing systems first, as the NCSC advises, and retire or isolate anything that can't be patched.
• Review custom web applications. Test for SQL injection and search frontend code for hardcoded keys, since both featured in the confirmed compromises.
• Compare your controls with the NCSC's Critical Controls. Patching, multi-factor authentication and centralised logging are all on the list, and logs let you spot unusual scanning and repeated logins.
• Rehearse a data breach. The Privacy Commissioner wants notification of a breach that has caused or might cause serious harm ideally within 72 hours of becoming aware of it, even while the investigation continues.
• Set rules for your own agents before go-live. Limit tool permissions, require evidence with every reported result, log every action, and require human approval where a mistake costs money or affects customers. Our AI agents page covers how we approach this work.