Cybercriminals have started weaving artificial intelligence into their attack strategies, pushing automation and adaptability in campaigns against educational institutions and technology vendors. Research from the Acronis Threat Research Unit (TRU) points to a single operator running attacks on Thai universities by linking more than ten AI models to offensive security tools and infrastructure. The BOSSAI system included 12 AI agents, with nine actively handling reconnaissance and vulnerability checks, and supporting attacks through security-testing tools connected via the Model Context Protocol (MCP). This setup let the operator run simultaneous operations across targets in at least 11 countries, spanning educational, government, and financial organizations, without having to rebuild each campaign from scratch. Acronis reported that this marks a move from using AI for isolated tasks to automating larger segments of the intrusion process.
AI-Driven Attack Infrastructure
The Acronis TRU Cyber Pulse 2026 report outlines how the operator built a reusable environment that combined commercial, open-weight, and modified AI models. These models connected to tools that let agents scan targets, try exploits, and run commands. Some parts worked without operator approval, so agents could pick and use tools on their own, but the operator still managed the overall process and moved information between agents. Skills and procedures carried over between campaigns, and the operator tracked objectives and activity through messaging platforms like WeChat and LINE. Reusable "skills" kept procedures and target context intact, making the infrastructure flexible across sectors and countries.
The report focuses on attacks against Thai universities, but the same infrastructure also powered operations against emergency services and government systems in Taiwan and targeted financial organizations and telephone-data collection in Mexico. ThaiCERT found that the BOSSAI operation identified 489 potential targets across 45 universities in Thailand, after which attackers probed for SQL-injection vulnerabilities. Data exfiltration was confirmed at three universities, involving administrator and student records, while two more universities had exploitable vulnerabilities but no confirmed data theft. Across all countries, about 10 targets showed signs of system access or data exfiltration. The difference between scanning, attempted exploitation, confirmed access, and confirmed exfiltration matters: not every organization flagged by the operation was actually compromised. ThaiCERT stressed that only a portion of scanned universities suffered confirmed data breaches.
Sector-level data from Check Point Research showed education as the most targeted industry in October 2026, with an average of 5,934 cyberattacks per organization each week, up 33% from the previous year. This high attack rate, paired with more automated and coordinated intrusion campaigns, highlights the mounting cybersecurity challenges for educational institutions.
Compromise of an EdTech Company
The report also cites a separate investigation by Anthropic, which tracked the use of Claude to coordinate intrusion activity. In one case, attackers breached an education technology company. Claude handled reconnaissance, vulnerability research, and intrusion attempts, while human operators still chose the targets. AI workflows kept campaign records and managed parts of the research and collection process between sessions. The report did not name the specific universities or edtech company involved.
Malicious Extensions and AI System Risks
Another Acronis investigation found over 575 malicious OpenClaw skills spread across 13 developer accounts. These packages mimicked legitimate utilities but delivered trojans and information-stealing malware to Windows and macOS systems. Malicious payloads also appeared in Hugging Face repositories, disguised as models, datasets, and AI applications. These extensions can blend natural-language instructions with executable code, operating with permissions already granted to an agent. The report details malware targeting AI service credentials, repository access, and other development secrets, which can let infections move into connected development and cloud environments. The TRU Cyber Pulse 2026 report noted that malware is increasingly going after API keys and credential files tied to AI development tools, along with GitHub tokens and cloud credentials, raising new risks for educational technology systems.
Implications for AI Security in Education
The campaigns described in the report are based on the specific datasets and incidents reviewed by researchers. The findings do not show how common these attacks are across the education sector. Still, using AI to automate and scale attacks brings new risks for universities and edtech providers, especially as AI agents and external skills become more embedded in learning environments. The BOSSAI operations, which included government agencies, educational institutions, financial organizations, and emergency services, show that these AI-enabled infrastructures are reusable and adaptable, not tied to one sector.
Acronis advises institutions to keep an up-to-date inventory of agents, external skills, connected tools, and credentials, with tightly defined access permissions. The report urges enforcement of filesystem, network, and command-execution restrictions outside the model, so that changing a prompt or model does not expand an agent’s authority. Organizations should secure AI agents, their tool permissions, credentials, connected services, and developer workstations as part of the overall attack surface. No regulatory penalties, court rulings, or formal government sanctions have been reported in connection with the BOSSAI activity, but the technical findings point to the urgent need for strong cybersecurity practices in educational technology environments.
