Acronis Discloses BossAI Attack Framework: Integrating 12 AI Agents and MCP Protocol Across 11 Countries
Acronis TRU reveals details of the BossAI attack framework, showing how attackers coordinate multiple AI agents via MCP and Skills for cross-border reconnaissance, despite high false-positive rates in automated vulnerability assessment.
The Threat Research Unit (TRU) at cybersecurity firm Acronis has released a report detailing the operational mechanics of an attack framework named "BossAI." Operated by an attacker believed to be located in Hualien, Taiwan, China, the framework integrates 12 AI agents, nine of which were actively used during the observation period. These agents did not establish direct communication channels; instead, the attacker manually passed work outputs between them, using the Model Context Protocol (MCP) to chain penetration testing tools and executing attacks with locally hosted AI models stripped of safety restrictions.
In attacks targeting emergency services in Taiwan, China, the attacker first used HalberdStrike to scan websites and obtain vulnerability reports. These reports were then analyzed by Hermes for potential attack paths, with the results provided to Cursor for further exploitation. This division of labor indicates that while some tasks could be automated, coordination between different AI agents remained heavily dependent on human intervention.
Attackers also utilized "Skills" to preserve attack workflows and past experiences. For instance, a skill named gov-api-penetration, specifically designed for government fire dispatch APIs, was frequently invoked, accumulating 51 uses. These SKILL.md files recorded operational instructions, scripts, and reference materials, allowing AI agents to reuse existing outcomes across different sessions or even after switching underlying models. Additionally, configurations such as HERMES_YOLO_MODE=1 were enabled to allow agents to automatically approve operations and load hook scripts, reducing the need for manual oversight.