Findings cover roughly 10 targets, exposed medical data, SQL injection and unreliable scanning, drawing on over 90,000 files
According to a threat-research report published on 4 November 2026, a single operator using AI agents had been able to gain access to (or took data from) roughly 10 targets across Taiwan, Thailand and Mexico.
The report analyses an exposed attacker working environment holding more than 90,000 files, including AI agent conversations, command histories, attack tools and victim data. It details the operator’s setup, targets and AI failures. It assesses the operator to be an individual in Hualien City, Taiwan.
During the 12 days of observed activity, organizations in 11 countries had been targeted. About 15 further targets had been attacked without confirmed compromise. Entities in eight other countries had faced only reconnaissance or staged, unlaunched attacks.
Attack details
The report described the most serious confirmed harm as a Taipei fire-department patient-care platform that exposed 2018 medical data, including ECG readings and vital signs, without requiring credentials. Agents had also pulled case records from a 119 emergency dispatch system, which the report said excluded real-time GPS tracking. Other confirmed compromises included SQL injection at three Thai universities and a Taiwanese lending-services firm. Also:
- Nine AI agents had been active, and three had been configured but unused.
- The agents did not communicate directly; the operator relayed output manually. The main attack agents mostly ran open-weight models with safety refusals removed, a technique known as abliteration.
- Two commercial models, xAI’s Grok 4.5 and MiniMax M3, had refused explicit attack requests when the operator could not show authorization, the report stated. How they would respond to a fake engagement letter was unclear, it added.
- The agents’ output was often unreliable. One scanning tool had reported a critical vulnerability that did not exist, and more than half of its high-severity and critical findings were false positives or misclassifications.
The report, published by Acronis’s Threat Research Unit, said harm clustered around already weakly protected systems, such as unpatched databases and a medical-data port open since 2018. It does not explain how compromises were verified independently of the agents’ logs, or divulge whether affected organizations or authorities were notified.
