Events Secure.com at Black Hat USA 2026
Published: November 9, 2026 4 min read

AI Attack Mesh Lets One Hacker Raid Emergency Services in 11 Countries

An AI attack mesh let one hacker aim 12 agents at emergency services, banks and schools in 11 countries. See what broke and the fixes.

By Secure.com
AI attack mesh diagram showing one operator relaying between builder, attacker and scanner agents across 11 countries
Summary

AI Attack Mesh Hits Taipei Fire Department Patient Records

  • Who should care: Emergency services, hospitals, universities, lenders, and anyone with public web apps running on old databases.
  • What could go wrong: One open portal, default password, or SQL injection bug now gets found in hours.
  • Do this: Hunt for the IOCs below. Then test your public apps for SQL injection and default logins this week.
  • Worth remembering: The AI was new. The holes it walked through were not.

Introduction

One person. Twelve AI agents. Eleven countries. Security researchers uncovered an AI attack mesh that let a lone hacker target emergency services, banks, and universities at a pace that normally takes a whole crew.

What Happened?

TRU spotted what looked like a misconfigured dev server. It was actually an open directory on the attacker’s own VPS, holding about 90,000 files and 9GB of logs. Inside was an AI attack mesh of 12 agents, as researchers describe it.

Builder agents set up servers and DNS. Attacker agents wrote exploit scripts and ran sqlmap 561 times. Scanner agents mapped targets through FOFA and Shodan. The agents never talked to each other, so the operator copied output between terminals by hand.

Commercial models refused to hack without written authorization, so the offensive work moved to local models with their safety training removed.

AI attack mesh diagram showing one operator relaying between builder, attacker and scanner agents across 11 countries

What’s the Impact?

About 10 targets in Taiwan, Thailand, and Mexico were confirmed breached. A Taipei fire department patient platform exposed ECG readings, ambulance video, and vital signs with no login at all.

The AI attack mesh also pulled 119 dispatch records, dumped admin tables at Thai universities, and compiled about 206,800 Mexican phone records.

The Robots Also Made Stuff Up

The AI attack mesh relied on a scanning harness that flagged a “critical” remote code flaw at a national disaster response center. The port was filtered. More than 50% of its high and critical findings turned out to be false or misclassified.

Where real authentication was in place, the mesh got nothing. A brute force run on a national fire agency SSO portal failed, and 2,600+ credential guesses against a news site produced zero valid logins.

AI attack mesh results comparing breaches caused by missing basic controls with targets where basic controls held

How to Avoid This

Every breach the AI attack mesh landed came through a basic gap. Close those first.

  • Block and hunt the IPs and domains on the IOC sheet below across 30 days of firewall, DNS, and proxy logs.
  • Remove default credentials from every admin panel and vendor console, starting with anything a supplier installed.
  • Test public apps for SQL injection, and patch or retire old database backends.
  • Put every patient, dispatch, or customer data portal behind real authentication and session controls.
  • Alert on bursts of sqlmap, nikto and ffuf traffic. That was the loudest fingerprint this mesh left.
AI attack mesh IOC sheet listing operator IP addresses, defanged domains, host artifacts, tools and ports

Point the Agents at Yourself First

This operator showed that AI makes finding weak spots in public web apps cheap. Governed defense means your own AI teammates find those spots first, inside rules your team sets.

  • Red Teammate attacks your public apps inside an approved scope, so SQL injection and default logins come up on your schedule.
  • Each finding is checked for real exploitability before it reaches your queue, so nobody chases fake CVEs.
  • Defensive teammates turn confirmed findings into fixes: credential resets, config changes, and patch tickets.
  • Human approval gates sit in front of anything that touches production.
  • Every action is logged as proof for auditors and leadership. Attack. Harden. Prove. Repeat.

FAQs

What is an AI attack mesh?
An AI attack mesh is a group of AI agents that one operator points at targets, with each agent handling a separate job such as building servers, scanning, or writing exploits. In the case found, a single hacker ran 12 agents and relayed their output by hand.
Who did the attacker target?
Emergency services, hospitals, banks, lenders, universities, and online stores across 11 countries. Researchers confirmed about 10 breaches in Taiwan, Thailand, and Mexico, including a Taipei fire department patient care platform.
How did the attacker get past AI safety guardrails?
Commercial models only helped with infrastructure and refused to hack without written authorization. The operator moved the offensive work to local models with their safety training removed.
How can I check whether my organization was hit?
Search at least 30 days of firewall, DNS, and proxy logs for the IPs and domains on the IOC sheet. Then look for bursts of sqlmap, nikto, and ffuf requests against login pages and admin panels, and logins using vendor default credentials.
Does AI make old vulnerabilities more dangerous?
Yes. The AI attack mesh did not use new exploits. It found missing logins, default passwords, and SQL injection faster and at greater scale. Where basic controls were in place, the agents got nothing.

Other News