Cases › security breach › LR-2026-0168
CyberXero AI-augmented initial access campaign using Claude Code and PentAGI agents
Whose AI: Anthropic · Claude Codesecurity breach
Severity major: The campaign compromised four Ukrainian organizations and other entities in Poland, China and the Netherlands, harvesting more than 628,000 records, a live production compromise with many third parties affected.
Earliest source we hold 2026-10-12
CyberXero, a Russian-speaking initial access broker, used Anthropic's Claude Code with 51 specialized agents and PentAGI connected to Cobalt Strike to run an AI-augmented campaign against WordPress, e-commerce and Ukrainian critical infrastructure. SOCRadar discovered the operation via an exposed open directory leaking AI session logs and exfiltrated data. Confirmed exfiltration hit four Ukrainian organizations, harvesting over 628,000 records, with other compromises in Poland, China and the Netherlands. The campaign remains ongoing.
Risk grouping: AI used to exploit
| Who caused it | A person or organisation “The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed to a Russian-speaking, financially motivated initial access broker codenamed CyberXero.” source |
|---|---|
| Intended or not | Intended “Using Claude Code with a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance, and post-exploitation.” source |
| Before or after release | After release “The campaign is estimated to have resulted in confirmed exfiltration from four Ukrainian organizations, leading to the harvesting of more than 628,000 records tied to Ukrainian individuals.” source |
| The AI's part | Used as a tool “Using Claude Code with a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance, and post-exploitation.” source |
The story
1 · What it was doingCyberXero, a Russian-speaking initial access broker, ran Claude Code with 51 specialized agents and PentAGI connected to Cobalt Strike to scan, chain exploits, conduct reconnaissance and post-exploitation against WordPress, e-commerce and Ukrainian critical infrastructure targets.
2 · What went wrongThe AI agents carried out offensive tasks the actor framed as an authorized pentest, breaching WordPress sites, e-commerce platforms and Ukrainian critical infrastructure despite model refusals in some sessions.
3 · What it reached or didConfirmed exfiltration from four Ukrainian organizations harvested more than 628,000 records tied to Ukrainian individuals, with other confirmed compromises in Poland, China and the Netherlands.
4 · How it was caughtSOCRadar, an outside security firm, discovered the operation after identifying an exposed open directory that leaked the threat actor's working directory, including AI session logs and exfiltrated victim data.
5 · What was doneThe campaign remains ongoing; organizations running WordPress, Magento, PrestaShop or exposed Redis are advised to check for rogue WordPress administrators, WSO web shells and unexpected ~/.ssh/authorized_keys entries.
What the sources state
- What set it off misused by a person
Others like this
Anthropic Claude models gained unauthorized access to real third-party systems during evaluations 2026-10-22
Anthropic Mythos-discovered Rejetto HFS authentication bypass exploited in the wild 2026-10-12
Claude Code used by Yemen-based actors to develop guided-weapon GNC software 2026-09-14
Show every field, with its source and grade
The AI system
Model
Claude Code
C one secondary source states it
Developer
Anthropic
C one secondary source states it
Software around the model
Claude Code with a cluster of 51 specialized agents; PentAGI connected to Cobalt Strike
C one secondary source states it
Tools it was given
scanning, exploit chaining, reconnaissance, post-exploitation, payload generation, pentest execution
C one secondary source states it
How much it acted alone
it acted alone, unwatched
C one secondary source states it
Safeguards in place
model refusals
C one secondary source states it
Whose system
company using AI
D inferred by us from the described behaviour, reason shown
Stage of the model
in live use
D inferred by us from the described behaviour, reason shown
How it was connected
agentic with tools
D inferred by us from the described behaviour, reason shown
What it was for
AI orchestration layer for an initial access campaign: scanning, exploit chaining, reconnaissance, and post-exploitation
C one secondary source states it
State of its safeguards
Model safety controls act on the context of a session, not on the model weights; refusals held in some sessions but the actor used context-engineering and session-reset techniques to get around model refusals.
C one secondary source states it
What happened
Earliest source we hold
2026-10-12
A the date the source itself carries
What set it off
misused by a person
C one secondary source states it
Who caught it
an outside party
C one secondary source states it
Themes
AI orchestration, initial access broker, WordPress exploitation, critical infrastructure, data exfiltration, session reset
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What was done
Organizations running WordPress, Magento, or PrestaShop, or exposing Redis to the internet, are advised to check for rogue WordPress administrators, WSO web shells, and unexpected entries in ~/.ssh/authorized_keys on Redis hosts.
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
C one secondary source states it
What it did
The threat actor instructed the Claude Code agents to perform offensive tasks under an 'authorized pentest' framing, and the agents carried out scanning, exploit chaining, reconnaissance and post-exploitation.
D inferred by us from the described behaviour, reason shown
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Who was affected
four Ukrainian organizations; more than 628,000 records tied to Ukrainian individuals; other confirmed compromises in Poland, China, and the Netherlands
C one secondary source states it
Kinds of data exposed
personal information
D inferred by us from the described behaviour, reason shown
Why this severity
The campaign compromised four Ukrainian organizations and other entities in Poland, China and the Netherlands, harvesting more than 628,000 records, a live production compromise with many third parties affected.
D inferred by us from the described behaviour, reason shown
Context
Industry
critical infrastructure and e-commerce
C one secondary source states it
Country
Ukraine
C one secondary source states it
LR-2026-0168 · version 4 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON