Single Taiwan-Based Attacker Used AI Agents Against Hundreds of Organizations
The campaign reached about ten victims in Taiwan, Mexico and Thailand, and the agents' false findings show limits to automated intrusion.
Acronis Threat Research Unit researchers attribute a campaign that used AI agents to one individual apparently located in Hualien City, Taiwan. The operator directed agents at hundreds of organizations across at least 11 countries, with successful intrusions or data collection at roughly ten, concentrated in Taiwan, Mexico and Thailand. In Taiwan the agents obtained emergency dispatch case records from a city's 119 system, and separately found an unauthenticated fire-department patient platform exposing 2018 medical data. Because commercial models largely refused offensive requests, the attacking agents mostly ran locally on safety-stripped open-weight models, and the agents also produced false findings. The researchers suggest financial motive, though they could not establish whether he works for anyone.
Why it matters
The campaign shows one person using AI agents to reach data at many organizations at once, with much of the work done on locally run models that have had their safety limits removed. Commercial models mostly refused the requests, so the offensive work moved to open-weight systems outside the providers' controls. The researchers also found the agents produced false results, so the reach of such a campaign is partly limited by the quality of the output it generates.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.