The evidence came from the attacker's own server, which at first looked like a misconfigured development system. It turned out to be his attack platform, holding more than 90,000 files: the agents' conversations, his command history, hacking tools, credentials and victims' data. According to the researchers, commercial models mostly refused to help, so the agents ran almost entirely on local versions of DeepSeek, GLM and Qwen with their safety training removed.
The most serious confirmed harm involved dispatch records from the 119 fire and ambulance system covering seven Taipei districts, pulled from an exposed API, and a fire department platform that exposed patient data from 2018 without a login. The agents also pulled data from a Taiwanese lending firm and three Thai universities through SQL injection. They also made mistakes: one scanning tool invented vulnerabilities, and more than half of its high and critical findings were wrong.
Acronis concludes that the agents mostly succeeded against data that was already poorly protected, and failed wherever logins or proper filtering were enforced. What to do: close exposed interfaces and ports, patch known database flaws and enforce authentication on every endpoint. It is unclear whether the affected organizations were notified.