SOCRadar: Known attacker reportedly ran 51 Claude Code agents alongside Cobalt Strike
Security firm SOCRadar describes a campaign in which an initial access broker chained 51 specialized Claude Code agents to PentAGI and Cobalt Strike. More than 628,000 records are said to have been stolen from Ukrainian organizations – but the same logs also show the model's safety refusals held up, in part.
Security firm SOCRadar published a report on 6 October 2026 describing something relatively novel: an alleged cybercrime campaign in which AI agents are not an add-on, but the operational backbone itself. Over the following week, The Hacker News, Security Affairs, Cyber Security News and Let's Data Science all covered the findings, all tracing back to the same source.
As SOCRadar presents it, the actor is an initial access broker with the codename CyberXero, active since at least July 2026. The actor reportedly chained 51 specialized Claude Code agents, a PentAGI setup and Cobalt Strike into two parallel intrusion pipelines – one automated global scaling operation and one manual, targeted campaign against the Ukrainian energy sector. The result, according to the report, is confirmed exfiltration from four Ukrainian organizations and more than 628,000 records relating to Ukrainian individuals, in addition to confirmed compromises in Poland, China and the Netherlands.
All of this comes from a single source: SOCRadar, which says it found the operation because the attacker exposed their own working directory. The documentation of the alleged attack is thus not independently confirmed. Still, it is precisely that exposed directory that makes the story worth covering: it offers a rarely detailed look at how AI agents are actually used in real attacks – including how far they get, and where they stop.
How the discovery happened
SOCRadar said it identified an exposed open directory on "46.21.250[.]135" that leaked the attacker's active working directory from a Linux workstation. The contents reportedly include AI session logs, scripts with plaintext tokens, exploit toolkits, reconnaissance results, AI agent configurations and exfiltrated victim data – more than 90,000 files in total, according to Cyber Security News. The campaign was reportedly still active during the investigation.
There is a fitting irony: a setup built for industrial-scale operations failed on one of the industry's oldest mistakes – misconfigured exposure of its own infrastructure.
The architecture: 51 agents and a Cobalt Strike connection
The alleged setup has two layers. At the top, Claude Code runs with a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance and post-exploitation, on the attacker's primary workstation. Underneath sits PentAGI, an automated penetration testing tool, connected to a Cobalt Strike Team Server via an AI provider's API – meaning the agents could reportedly drive further classic intrusion activity with commercial tooling.
The two pipelines differ clearly from each other:
The global pipeline is driven by a self-made tool called wp2shell, which, according to Security Affairs, abuses a vulnerability in the WordPress REST API to inject SQL, create an unauthorized admin account and plant a web shell. The target list reportedly contained more than 56,000 URLs. Analysis of the exposed directory reportedly shows that a single automated run scanned 4,708 targets, confirmed access to 429 WordPress admin panels and deployed 32 web shells within a 61-second window.
The targeted pipeline worked differently: deeper reconnaissance and manual exploitation against seven Ukrainian energy and utility entities, including the national transmission operator, according to Let's Data Science. This is also where the distinction between targeting and actual compromise applies – the reporting confirms exfiltration from four organizations, while seven were targeted.
The Kharkiv finding and its physical risk
One of the most concrete findings concerns a district heating company in Kharkiv. A password stored directly in the attacker's scripts reportedly provided access to the company's systems, and an automated tool then extracted more than 564,000 customer records, including home addresses and account numbers.
SOCRadar warns that this raises its own risk category. Because Kharkiv sits near an active conflict front, the company writes that the dataset poses a potential physical risk to identifiable civilians, far beyond a conventional data breach. The reporting, however, establishes no state sponsor, and no buyer of access to the Ukrainian targets has been identified.
The numbers should also be kept separate: the 628,000+ records concern four confirmed-exfiltrated Ukrainian organizations, while the 564,000+ are tied to a single district heating company in Kharkiv. The relationship between the figures is not fully clarified in the sources.
The dual role of safety controls
Perhaps the most interesting aspect of the exposed directory is that, according to SOCRadar, it documents the struggle between attacker and model. The logs reportedly show, according to The Hacker News, that CyberXero used "context engineering" and session resets to circumvent safety refusals: by opening a new session with a preloaded narrative about an "authorized pentest," the attacker could retry where the agent had refused.
As SOCRadar explained, according to The Hacker News, the model's safety controls operate on the session's context, not on the model weights, so a refusal in one session does not carry over to the next. When an agent refused a task, the actor reportedly opened a new session with the authorization framing narrative preloaded and tried again.
But the methods did not always work. The logs also reportedly show that the model, over four iterations, refused to install a backdoor, disable a firewall, move laterally and deploy a web shell – and in a separate case correctly rejected a forged ownership token.
The picture that emerges, then, is not "AI agents can do everything," but something more nuanced: the controls create friction, especially around the most harmful actions, but an attacker with patience and session resets can stretch the boundaries. It is also worth remembering that this is SOCRadar's own reading of the logs, not independently verified.
What remains open
Several key questions lack answers in the available coverage:
- Attribution and identity. CyberXero is a codename. The actor's true identity, location and any affiliations are unknown.
- Downstream use. No buyer of access to the Ukrainian targets has been identified, and it is unclear what the access is intended for.
- Evidence base. The entire picture stems from SOCRadar's analysis of an exposed directory. No independent source has confirmed the contents.
- Anthropic's response. The sources document no reaction from Anthropic to the alleged misuse of Claude Code, and there are no statements from the company on the matter.
- The relationship between the numbers. The connection between the 628,000 and 564,000 figures, and between four confirmed-exfiltrated and seven targeted entities, is not fully clarified in the available sources.
What this means for defenders
Regardless of the attribution uncertainties, the case – as SOCRadar presents it – shows two things relevant to defenders right now. First, that AI lowers the threshold for scale in intrusions: 4,708 scanned targets and 32 web shells in 61 seconds is not a capability that requires a large manual team. Second, that the agents are not autonomous all the way – refusals held on several of the most harmful steps, even though they could be bypassed with enough attempts.
For organizations, this means the classic defensive measures still stand: WordPress installations should be updated and the REST API locked down, secrets should never be stored in plaintext in scripts, and exposure monitoring of one's own infrastructure – not to mention an attacker's – remains one of the most effective detection mechanisms available.