SOCRadar reports finding Claude Code agent definitions, PentAGI configuration and offensive tooling in an exposed working directory associated with CyberXero. Its October 6 investigation supports an account of AI-assisted intrusion workflows, but does not establish that every successful intrusion was autonomous. The vendor separates two operational…
Inspect the ClaimsCase · DiggingBeagle record
CyberXero used AI agent infrastructure in reported Ukrainian intrusions
SOCRadar reports exposed attacker infrastructure containing up to 51 defined Claude Code agents, PentAGI configuration and Cobalt Strike-linked orchestration.
Scope
Operational threat intelligence report published October 6, 2026. Vendor-side analysis of exposed attacker materials; independently confirmed individual victim losses are limited.
Assessment profile
Assessment method- Setting
- production
- AI role
- WITH AI
Basis and provenance
SOCRadar reports operational intrusions and recovered AI-related artifacts. The degree of AI execution in each intrusion is unresolved, so the AI-specific exploitation dimension remains unknown rather than inheriting all campaign outcomes. Primary passages were inspected in this review, but the pinned contract supplies no grading rubric for A-D or the numeric impact bands; both remain ungraded. This is a source review, not an independent reproduction.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-R4-CYBERXERO-1 · CLM-R4-CYBERXERO-2 · CLM-R4-CYBERXERO-3 · CLM-R4-CYBERXERO-4 · SOCRadar: CyberXero, an AI-Augmented Initial Access Broker
At a glance
AI-agent role definitions and prompts can become durable forensic records of offensive workflows, but configuration presence is not proof of every alleged action.
Read the implicationsThe precise degree of agent autonomy per intrusion is not established. Whether data-access claims were verified independently with every victim and whether access was sold remain uncertain. The underlying exposed directory and victim datasets were not accessed in this review; claims about recovered material remain attributed to SOCRadar.
Limits and uncertaintyFull account
SOCRadar reports finding Claude Code agent definitions, PentAGI configuration and offensive tooling in an exposed working directory associated with CyberXero. Its October 6 investigation supports an account of AI-assisted intrusion workflows, but does not establish that every successful intrusion was autonomous.
The vendor separates two operational pipelines: opportunistic automation against web platforms and more selective, manually directed targeting of Ukrainian organizations. The recovered material reportedly included up to 51 defined Claude Code agents, configuration for PentAGI, session histories and Cobalt Strike-linked orchestration. Defined agent roles are evidence of configured capability; their count is not a count of successful attacks or independently operating intruders.
The session material also records model refusals and repeated attempts to claim legitimate authorization. SOCRadar describes the same authorization story across four unrelated victims and two tools. It interprets that repetition as rehearsed safety-evasion framing. Nothing in the reported ownership claims verifies that the operator actually had permission, and the logs do not establish that every attempt to overcome a refusal succeeded.
The victim evidence has its own boundary. SOCRadar distinguishes exfiltrated files associated with four Ukrainian organizations from reconnaissance of seven additional energy-sector entities without confirmed compromise. It also reports datasets involving more than 628,000 individuals. Those different populations cannot be added into one victim total or attributed wholesale to autonomous agents.
This dossier relies on SOCRadar's analysis of the exposed material. The underlying directory and victim datasets were not accessed for this review, and the operator's state affiliation, degree of human intervention and reported sale of access remain unresolved. The AI-security finding concerns how agent tools were configured and used within the operation; the surrounding campaign does not prove a universal bypass of model safeguards.
Mechanism and trust boundary
- 01
Offensive workflow
SOCRadar describes an operator combining conventional exploitation tooling with Claude Code agent definitions and PentAGI integration.
Boundary: The operator's authority claims are inputs to the models, not evidence of legitimate target permission.
- 02
Claimed authorization
The report identifies repeated fictional engagement narratives in recovered session material.
Boundary: A claimed testing mandate must be distinguished from authorization by the affected organization.
- 03
Separate evidence layers
The report links configuration, session histories and exfiltrated files, but these do not establish autonomous AI execution of every intrusion step.
Boundary: Agent presence, attempted requests and observed victim data are different evidence categories.
Timeline
- Oct 6, 2026disclosure
Public disclosure
Claims & evidence
CLM-R4-CYBERXERO-1SOCRadar reports exposed attacker infrastructure containing up to 51 defined Claude Code agents, PentAGI configuration and Cobalt Strike-linked orchestration.supported
Basis: reported finding
- supportsSOCRadar: CyberXero, an AI-Augmented Initial Access Brokerprimary disclosure
Key Takeaways and "The AI Augmentation Layer" sections.
CLM-R4-CYBERXERO-2SOCRadar reported evidence of four Ukrainian organizations with exfiltrated files and over 628,000 individuals in relevant datasets, but did not establish that all successful intrusions were autonomous.supported
Basis: reported finding
- supportsSOCRadar: CyberXero, an AI-Augmented Initial Access Brokerprimary disclosure
Key Takeaways, "Two Pipelines, One Operator" and victimology.
CLM-R4-CYBERXERO-3SOCRadar separates file-confirmed exfiltration at four Ukrainian organizations from curated reconnaissance of seven more energy-sector entities without confirmed compromise. Those categories must not be combined into one victim total.supported
Basis: reported finding
- supportsSOCRadar: CyberXero, an AI-Augmented Initial Access Brokerprimary disclosure
Victimology, opening paragraph.
CLM-R4-CYBERXERO-4SOCRadar describes the same purported authorization narrative across four unrelated victims and two tools in recovered session material. Its interpretation is repeated safety-evasion framing, not proof that the claimed authorization existed.supported
Basis: reported finding
- supportsSOCRadar: CyberXero, an AI-Augmented Initial Access Brokerprimary disclosure
The AI Augmentation Layer, paragraph on the fictional authorization protocol.
Implications
AI-agent role definitions and prompts can become durable forensic records of offensive workflows, but configuration presence is not proof of every alleged action.
Unknowns and contradictions
- The precise degree of agent autonomy per intrusion is not established.
- Whether data-access claims were verified independently with every victim and whether access was sold remain uncertain.
- The underlying exposed directory and victim datasets were not accessed in this review; claims about recovered material remain attributed to SOCRadar.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 141