research (Acronis Threat Research Unit, published Nov 4, 2026); victim counts, attribution and model behavior are Acronis's findings from an exposed attacker environment; Acronis assesses with high confidence a single operator in Hualien City, Taiwan
Acronis: one operator ran a 12-agent AI mesh against hundreds of organizations in 11 countries, and pulled Taipei 119 dispatch records
How it worked: the operator relayed results between agents by hand, pasting scan reports from a PentestGPT-based tool and a cracked Acunetix into the main Hermes-harness agent and IDE agents for exploitation. The main agent ran in auto-approve mode with a system prompt telling it not to ask before acting.
Persistent offensive skills: reusable SKILL.md playbooks (for example a government emergency-API skill used 51 times) patched themselves after each run, so recon carried across sessions and model swaps.
Where it failed: targets that enforced authentication and filtered endpoints held. Most confirmed harm came from data that was already weakly protected, such as an open legacy port and SQL-injectable legacy subdomains.
Takeaway: agentic tooling made it cheap to reach hundreds of targets in parallel, so obscurity stops being a defense; basic authentication and input validation still stopped it.