BOSSAI AI Agent Breach: Taipei Emergency Dispatch Records Stolen — Detection and Hardening Guide

In a stark demonstration of how artificial intelligence is being weaponized against critical infrastructure, researchers at Acronis’s Threat Research Unit have confirmed that a single attacker using BOSSAI AI agents successfully exfiltrated emergency dispatch records spanning seven districts in Taipei. The same campaign uncovered a Taipei fire department platform that had been exposing patient data—including ECG readings and ambulance video footage—since 2018, with no login required.

This is not a theoretical exercise. It is a live, confirmed breach of systems that directly impact public safety and medical privacy. For SOC teams, CISOs, and incident responders, the incident is a wake-up call: autonomous AI agents are now being used to conduct reconnaissance, identify misconfigurations, and exfiltrate sensitive data at a scale and speed that previously required a coordinated team. The fact that investigators are “highly confident” the actor is a single individual underscores how these tools are democratizing advanced offensive capabilities.

This post breaks down the attack chain from a defender’s perspective, provides detection logic you can deploy today, and outlines the immediate hardening steps required to protect emergency response infrastructure, healthcare data, and any public-facing application handling personally identifiable information (PII).

Technical Analysis

What Happened

According to Acronis’s Threat Research Unit, the attacker—believed to be a lone individual based in Taiwan—leveraged BOSSAI AI agents to automate the discovery and exploitation of vulnerabilities in Taipei’s emergency dispatch infrastructure. The agents were tasked with identifying exposed systems, probing for weak or missing authentication, and extracting records.

The primary targets were:

• Taipei Emergency Dispatch Systems: Seven districts had their dispatch records compromised. These systems contain real-time and historical data on emergency calls, unit deployments, and response coordination.
• Taipei Fire Department Platform: A separate, long-standing misconfiguration exposed patient data dating back to 2018, including ECG (electrocardiogram) readings and ambulance video footage. Critically, this platform required no login for access.

Attack Chain and Exploitation Requirements

While no CVE has been publicly assigned to this campaign, the attack pattern is clear and aligns with known AI-assisted offensive techniques:

1. Reconnaissance (Automated): The BOSSAI AI agents scanned public-facing IP ranges and domains associated with Taipei municipal services. Unlike traditional scanning, these agents can interpret HTML responses, identify application logic, and prioritize targets that handle sensitive data (e.g., dispatch records, medical telemetry).
2. Discovery of Unauthenticated Endpoints: The fire department platform was found to serve patient data directly over HTTP/HTTPS without any authentication mechanism. This is a classic case of CWE-306: Missing Authentication for Critical Function and CWE-359: Exposure of Private Personal Information to an Unauthorized Actor.
3. Data Exfiltration: Once identified, the AI agents systematically enumerated accessible records, including dispatch logs and archived patient media. The use of AI agents suggests the exfiltration was likely throttled to avoid rate-limiting and designed to mimic legitimate API or web traffic patterns.
4. Persistence (Unconfirmed but Probable): Given the exposure dates back to 2018, it is possible the attacker established a low-and-slow collection mechanism, though the summary does not confirm long-term persistence.

Affected Products, Versions, and Platforms

• Platforms: Taipei City emergency dispatch systems and the Taipei Fire Department patient data portal.
• Versions: Specific software versions are not disclosed in the source, but the exposure of data from 2018 indicates the vulnerable configuration has been in place for over eight years.
• Architecture: Web-based applications and APIs accessible from the public internet, likely hosted on municipal or contractor-managed infrastructure.

Exploitation Status

• In-the-Wild Exploitation: Confirmed. This is not a proof-of-concept or a lab scenario; the breach is active and has resulted in the confirmed loss of emergency dispatch and patient data.
• PoC Availability: No public proof-of-concept code is referenced, but the use of commercial or custom AI agent frameworks (BOSSAI) indicates the tooling is operational and effective.
• CISA KEV: Not listed. This is a targeted incident rather than a widespread CVE-driven campaign, though the underlying weaknesses (unauthenticated data exposure) are common and well-documented.

Why This Matters

The Taipei incident is a blueprint for future attacks against emergency services, healthcare providers, and municipal infrastructure. The use of AI agents reduces the skill floor for conducting large-scale, targeted breaches. Defenders must now assume that any exposed API, misconfigured cloud storage bucket, or unauthenticated web portal can be discovered and exploited by an autonomous agent within hours, not weeks.

Detection & Response

TECHNICAL THREAT — Detection Content Required

The following detection content is designed to identify the behaviors associated with AI-agent-driven reconnaissance and data exfiltration from web applications, specifically those lacking authentication or serving sensitive data.

Sigma Rules

---
title: Unauthenticated Access to Sensitive API or Web Endpoint
id: 3f8a1b2c-9d4e-4c7a-a1b2-3e4f5a6b7c8d
status: experimental
description: Detects successful HTTP GET requests to sensitive API endpoints (e.g., /api/patients, /api/dispatch, /api/records) that do not contain an Authorization header or session cookie. This may indicate unauthenticated data exposure as seen in the Taipei Fire Department breach.
references:
  - https://thehackernews.com/2026/11/taiwan-based-hacker-used-bossai-ai.html
  - https://cwe.mitre.org/data/definitions/306.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1059
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: 'GET'
    sc-status: 200
    cs-uri-stem|contains:
      - '/api/patients'
      - '/api/dispatch'
      - '/api/records'
      - '/api/ecg'
      - '/api/ambulance'
      - '/patient/'
      - '/dispatch/'
    cs-header-authorization: null
    cs-cookie: null
  condition: selection
falsepositives:
  - Legitimate public API endpoints designed for unauthenticated access (e.g., public status pages). Tune cs-uri-stem to match only sensitive paths.
level: high
---
title: High-Volume Data Retrieval from Single Source
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects a single source IP making an abnormally high number of requests to sensitive endpoints within a short time window. This pattern is consistent with automated data scraping or exfiltration by an AI agent.
references:
  - https://thehackernews.com/2026/11/taiwan-based-hacker-used-bossai-ai.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1059
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: 'GET'
    sc-status: 200
    cs-uri-stem|contains:
      - '/api/'
      - '/records'
      - '/patient'
      - '/dispatch'
  timeframe: 5m
  condition: selection | count() by c-ip > 100
falsepositives:
  - Legitimate search engine crawlers (e.g., Googlebot, Bingbot). Filter by known crawler user agents or IP ranges.
  - Internal health checks or monitoring tools.
level: medium

KQL (Microsoft Sentinel / Defender)

// Hunt for unauthenticated access to sensitive API endpoints
// This query identifies successful GET requests to API paths that lack an Authorization header or session cookie.
// Ingest your web server logs (IIS, Apache, Nginx, or application logs) into CommonSecurityLog or a custom table.

let SensitivePaths = dynamic(["/api/patients", "/api/dispatch", "/api/records", "/api/ecg", "/api/ambulance", "/patient/", "/dispatch/"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod == "GET"
| where RequestURL has_any (SensitivePaths)
| where isempty(RequestHeaders["Authorization"]) and isempty(RequestCookies)
| where ResponseCode == 200
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, RequestURL, RequestUserAgent
| order by RequestCount desc

// Hunt for high-volume data retrieval from a single source
// This query flags source IPs making more than 100 requests to sensitive paths within a 5-minute window.
let SensitivePaths = dynamic(["/api/", "/records", "/patient", "/dispatch"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod == "GET"
| where RequestURL has_any (SensitivePaths)
| where ResponseCode == 200
| summarize RequestCount = count() by SourceIP, bin(TimeGenerated, 5m)
| where RequestCount > 100
| order by RequestCount desc

Velociraptor VQL

-- Hunt for suspicious web server access patterns indicative of unauthenticated data scraping
-- This artifact targets IIS or Apache access logs for GET requests to sensitive paths without an Authorization header.
-- Adjust the log path to match your environment (e.g., C:/inetpub/logs/LogFiles/W3SVC1/*.log or /var/log/apache2/access.log).

SELECT 
    Time, 
    SourceIP, 
    Method, 
    UriStem, 
    UserAgent, 
    Status, 
    Headers
FROM parse_evtx(
    filename="C:/inetpub/logs/LogFiles/W3SVC1/*.log", 
    accessor="file"
)
WHERE Method = "GET"
  AND Status = 200
  AND (
    UriStem =~ "/api/patients|/api/dispatch|/api/records|/api/ecg|/api/ambulance|/patient/|/dispatch/"
  )
  AND (
    Headers.Authorization IS NULL OR Headers.Cookie IS NULL
  )
ORDER BY Time DESC

Remediation Script (PowerShell)

# This script audits and remediates unauthenticated access to sensitive web endpoints on IIS.
# It is designed for Windows Server environments hosting the affected applications.

# Step 1: Define sensitive paths
$SensitivePaths = @(
    "/api/patients",
    "/api/dispatch",
    "/api/records",
    "/api/ecg",
    "/api/ambulance",
    "/patient/",
    "/dispatch/"
)

# Step 2: Audit IIS sites for unauthenticated access to sensitive paths
Import-Module WebAdministration
$Sites = Get-Website
foreach ($Site in $Sites) {
    $SiteName = $Site.Name
    Write-Host "Auditing site: $SiteName" -ForegroundColor Cyan
    foreach ($Path in $SensitivePaths) {
        $VirtualPath = "/" + $Path.TrimStart('/')
        $AuthConfig = Get-WebConfiguration -Filter "/system.webServer/security/authentication/anonymousAuthentication" -PSPath "IIS:\Sites\$SiteName" -Location $VirtualPath -ErrorAction SilentlyContinue
        if ($AuthConfig -and $AuthConfig.enabled -eq $true) {
            Write-Warning "Site '$SiteName' allows anonymous access to path '$VirtualPath'."
            # Remediation: Disable anonymous authentication for the sensitive path
            Set-WebConfiguration -Filter "/system.webServer/security/authentication/anonymousAuthentication" -PSPath "IIS:\Sites\$SiteName" -Location $VirtualPath -Value @{enabled=$false}
            Write-Host "Disabled anonymous authentication for '$VirtualPath' on site '$SiteName'." -ForegroundColor Green
            # Enable Windows Authentication (or another method) as a fallback
            Set-WebConfiguration -Filter "/system.webServer/security/authentication/windowsAuthentication" -PSPath "IIS:\Sites\$SiteName" -Location $VirtualPath -Value @{enabled=$true}
            Write-Host "Enabled Windows Authentication for '$VirtualPath' on site '$SiteName'." -ForegroundColor Green
        }
    }
}

# Step 3: Verify firewall rules are not exposing management interfaces
$MgmtPorts = @(80, 443, 8080, 8443)
foreach ($Port in $MgmtPorts) {
    $Rule = Get-NetFirewallRule -DisplayName "Allow HTTP/HTTPS" -ErrorAction SilentlyContinue | Where-Object { $_.LocalPort -eq $Port }
    if ($Rule -and $Rule.Profile -eq "Any") {
        Write-Warning "Firewall rule for port $Port is set to 'Any' profile. Restrict to 'Private' or 'Domain' if possible."
    }
}

Write-Host "Audit and remediation complete. Review the output above for any changes made." -ForegroundColor Cyan

Remediation

The Taipei incident is not a patch-level vulnerability; it is a configuration and architecture failure. Remediation must focus on enforcing authentication, eliminating unnecessary exposure, and implementing robust monitoring.

Immediate Actions (24–48 Hours)

1. Identify and Inventory All Public-Facing Endpoints: Conduct an immediate external scan of your infrastructure to identify every web application, API, and data repository accessible from the internet. Use tools like Shodan, Censys, or your own attack surface management platform.
2. Enforce Authentication on All Sensitive Data Endpoints: No system serving PII, PHI (Protected Health Information), or emergency dispatch records should be accessible without strong authentication. Implement OAuth 2.0, OpenID Connect, or mutual TLS for APIs. For legacy systems, place an authenticated reverse proxy (e.g., Azure Application Gateway, AWS WAF with Cognito, or an NGINX reverse proxy with LDAP integration) in front of the application.
3. Block Unauthenticated Access to Historical Data: The Taipei Fire Department platform exposed data from 2018. This indicates a failure to implement data lifecycle management. Immediately purge or archive old data to a secure, offline, or air-gapped environment. If data must remain online, ensure it is behind the same authentication and authorization controls as current data.
4. Implement Rate Limiting and Behavioral Analytics: Deploy a Web Application Firewall (WAF) or API gateway that can detect and block high-volume requests from a single source. Configure alerts for requests to sensitive endpoints that lack an Authorization header.

Short-Term Actions (1–2 Weeks)

5. Deploy the Detection Rules Above: Integrate the Sigma, KQL, and VQL rules into your SIEM (Splunk, Sentinel, QRadar, etc.) and SOAR platforms. Test them against your web server logs to ensure they fire on the target behaviors and do not generate excessive false positives.
6. Conduct a Configuration Review: Use a tool like OWASP ZAP, Burp Suite, or Nessus to scan your applications for missing authentication, directory traversal, and information disclosure vulnerabilities. Pay special attention to API endpoints that return sensitive data in JSON or XML format.
7. Review and Harden IAM Policies: Ensure that service accounts, API keys, and database credentials are not hardcoded or exposed in public repositories. Rotate any credentials that may have been accessed during the breach.

Long-Term Strategic Changes

8. Adopt a Zero-Trust Architecture: Assume that any public-facing endpoint can be discovered and probed by an AI agent. Enforce least privilege access, micro-segmentation, and continuous verification for all users and devices, even those inside the network perimeter.
9. Implement AI-Aware Threat Hunting: Traditional IOC-based hunting is insufficient against AI agents that can dynamically change their TTPs. Focus on behavioral anomalies: unusual data access patterns, geographic impossibilities, and deviations from baseline API usage. Consider deploying UEBA (User and Entity Behavior Analytics) solutions.
10. Regularly Audit Third-Party and Municipal Systems: The Taipei incident involved a fire department platform that may have been managed by a contractor. Ensure that all third-party vendors and government agencies handling your data adhere to the same security standards. Include these systems in your regular penetration testing and vulnerability management programs.

Vendor and Regulatory Guidance

• Acronis Threat Research Unit: Monitor their publications for updates on the BOSSAI campaign. Their blog is the primary source for TTPs and IOCs.
• NIST SP 800-207 (Zero Trust Architecture): Use this as the blueprint for redesigning your network access controls.
• CISA: While this incident is not in the KEV, CISA’s #StopRansomware and #ProtectYourData campaigns provide relevant guidance for securing public-facing applications.

Conclusion

The use of BOSSAI AI agents to breach Taipei’s emergency dispatch system is a watershed moment. It proves that a single actor, armed with the right tools, can compromise critical infrastructure and expose years of sensitive data. The era of assuming that only nation-states or organized crime groups can execute such campaigns is over.

Your defense must evolve from reactive patching to proactive, behavior-based detection and zero-trust architecture. The rules and steps outlined in this post are your starting point. Deploy them, test them, and adapt them to your environment. The next AI agent may already be probing your perimeter.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub