{"schema_version":"0.10.0","id":"LR-2026-0684","record_version":1,"title":"Attack on SWG Legends fan server using AI tools","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":42.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.56,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"cb6cc8725126384dcb2d520b9d50d84496d9c2c9f4961e9039b41287e2269d1b"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-01","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"victim","summary":"A moderator of the r/swg subreddit, using the handle levarrishawk, admitted he carried out an attack using AI tools to gain access to files of the SWG Legends fan project, which revives Star Wars Galaxies. The developers confirmed the attack and said the access reached game assets. They said the attacker had been offering these files to other servers, though they could not confirm buyers. The developers stated that no player data was affected. The attacker said the motive was a conflict dating to 2012 over an earlier project. The breach was disclosed through the attacker's admission and the developers' confirmation, and the attacker said he would leave the files in the public domain.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK07"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data of others touched with a bounded scope stated. Fact: the developers say the access concerned exclusively client files of game assets.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://ixbt.games/en/news/2026/09/01/431801-spustia-14-let-geimer-s-pomoshhiu-ii-vzlomal-fanatskii-server-star-wars-galaxies-ctoby-otomstit-obidcikam.html","publisher":"iXBT.games","date":"2026-09-01","type":"press","title":"After 14 years, a gamer used AI to hack a Star Wars Galaxies fan server to get revenge on his offenders - iXBT.games","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.incident_class":"C","event.detection_method":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"The moderator of the \"r/swg\" subreddit, under the nickname levarrishawk, admitted that he carried out an attack using AI tools to gain access to the files of the fan project SWG Legends, dedicated to the revival of Star Wars Galaxies."}],"event.detection_method":[{"source_index":0,"quote":"The developers confirmed the attack and said that levarrishawk was able to gain access to game assets:"}],"impact.severity":[{"source_index":0,"quote":"This is exclusively about client files of game assets."}],"impact.severity_because":[{"source_index":0,"quote":"This is exclusively about client files of game assets."}],"event.summary":[{"source_index":0,"quote":"The moderator of the \"r/swg\" subreddit, under the nickname levarrishawk, admitted that he carried out an attack using AI tools to gain access to the files of the fan project SWG Legends, dedicated to the revival of Star Wars Galaxies."},{"source_index":0,"quote":"The developers confirmed the attack and said that levarrishawk was able to gain access to game assets:"},{"source_index":0,"quote":"We know that he has been actively offering these files to other servers, and while we cannot confirm if he has already found buyers, if you start seeing content exclusive to Legends in other projects — it was most likely taken from us."},{"source_index":0,"quote":"We want to emphasize: no player data was affected."},{"source_index":0,"quote":"Soon, levarrishawk himself spoke out and explained that the reason for the attack was a long-standing conflict that has been going on since 2012."},{"source_index":0,"quote":"In the meantime, I will leave all this here, in the public domain, for anyone who needs it."}]},"notes_on_gaps":"The sources do not name the AI model, its developer, the tools used, or the date the access occurred. The only source is one press article, machine-translated from Russian, reporting an attacker's admission and the developers' statement. The disclosure date is taken as the article date 2026-09-01. Trigger is judged as human_misuse because the cause given is the attacker's revenge over a dispute. The source does not describe an autonomous agent, so failure_class and agent fields are left out. Adversarial actor and responsible party are not stated and are left out. Severity is judged moderate because the source states a bounded scope (client files of game assets) but no count of affected parties. Harm class ip rests on the offering of the files and the copyright-like nature of the assets. No remediation is reported. The control H3 is inferred from the encrypted files being accessed; the source does not state which control was intended. Financial loss, duration, and containment time are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"A moderator admitted using AI tools to access the files of the SWG Legends fan project.","quote":"The moderator of the \"r/swg\" subreddit, under the nickname levarrishawk, admitted that he carried out an attack using AI tools to gain access to the files of the fan project SWG Legends, dedicated to the revival of Star Wars Galaxies.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The access exposed game assets covering the project's custom content.","quote":"This gave him access to the assets of all our custom content: items, quest storylines, and even Bespin.","source_index":0,"grade":"C"},{"step":"caught","text":"The developers confirmed the attack.","quote":"The developers confirmed the attack and said that levarrishawk was able to gain access to game assets:","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://ixbt.games/en/news/2026/09/01/431801-spustia-14-let-geimer-s-pomoshhiu-ii-vzlomal-fanatskii-server-star-wars-galaxies-ctoby-otomstit-obidcikam.html"]},"analysis":{"sections":{"timeline":[{"text":"The conflict between the parties began.","quote":"The conflict had been ongoing since 2012, and AI capabilities allowed the gamer to gain access to encrypted project files that they were unwilling to share.","source_index":0,"when":"2012"},{"text":"The developers confirmed the attack.","quote":"The developers confirmed the attack and said that levarrishawk was able to gain access to game assets:","source_index":0,"when":null},{"text":"The attacker spoke out and gave the conflict as the reason for the attack.","quote":"Soon, levarrishawk himself spoke out and explained that the reason for the attack was a long-standing conflict that has been going on since 2012.","source_index":0,"when":null},{"text":"The developers stated that no player data was affected.","quote":"We want to emphasize: no player data was affected.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://ixbt.games/en/news/2026/09/01/431801-spustia-14-let-geimer-s-pomoshhiu-ii-vzlomal-fanatskii-server-star-wars-galaxies-ctoby-otomstit-obidcikam.html"]}}