CyberXero's 51 Claude Code Agents: 429 WordPress Admin Panels Taken in 61 Seconds

What happened: the hackers left their workstation door open, exposing 51 AI agents

On October 6, threat intelligence firm SOCRadar published a research report; on October 12, The Hacker News followed up and pushed the story to the top of the security world: a threat actor codenamed CyberXero had turned Anthropic's Claude Code into a "hacker army" — 51 specialized agents covering scanning, exploit chaining, reconnaissance, and post-exploitation, running a two-pipeline campaign against WordPress sites, e-commerce platforms, and Ukrainian critical infrastructure worldwide.

SOCRadar's profile of CyberXero is specific: a Russian-speaking, financially motivated initial access broker — a middleman that breaks into systems and resells that access to other criminals. The group has been active since at least July 2026.

The most dramatic part is how it was exposed: SOCRadar found an open directory on the attacker's primary workstation (46.21.250.135) leaking its live working directory — AI session logs, plaintext tokens, exploitation toolkits, reconnaissance output, agent configuration files, even victim data. The hackers effectively live-streamed their own war room to researchers.

Two pipelines: one for volume, one for depth

The most interesting design choice in this operation is its two-pipeline structure — automate what can be quantified, keep humans on the targets that matter:

Pipeline A: global and automated. Targeting WordPress and e-commerce platforms with known vulnerabilities: wp2shell (CVE-2026-63030 and CVE-2026-60137) and an SQL injection flaw in the Support Board WordPress plugin (CVE-2026-4815). SOCRadar reconstructed one automated run from the leaked logs: 4,708 targets scanned, 429 WordPress admin panels confirmed accessible, 32 web shells deployed — all in 61 seconds. The goal is volume: monetize access directly by selling it or stealing payment data.

Pipeline B: targeted and manual. Aimed at Ukrainian energy and critical infrastructure, human-directed, carefully selected targets, deep reconnaissance plus manual exploitation. Four Ukrainian organizations had confirmed data exfiltration totaling over 628,000 records tied to Ukrainian individuals; a single district heating provider in Kharkiv lost 564,073 subscriber records, including names, home addresses, and account numbers. Confirmed compromises also occurred in Poland, China, and the Netherlands; internet-exposed Redis servers led to the breach of two Chinese entities.

AI's two positions in the kill chain

SOCRadar's report breaks down AI usage precisely — it appears at two independent stages of the attack lifecycle:

First, 51 Claude Code agents on the attacker's workstation. Not one general-purpose assistant, but a departmentalized setup: reconnaissance agents mapping targets, exploitation agents firing payloads, lateral-movement agents navigating compromised networks, exfiltration agents collecting records and uploading them to attacker infrastructure. Running on the threat actor's primary Linux workstation.

Second, PentAGI wired into Cobalt Strike. PentAGI is an open-source, self-hosted AI agent for fully autonomous penetration testing; CyberXero connected it to a Cobalt Strike Team Server through an AI provider API for payload generation and pentest execution. The old red-team tradecraft, now driven by an AI agent.

SOCRadar reconstructed the full attack architecture as eight distinct nodes — attacker workstation, provisioning server, monetization infrastructure, payload staging servers, a scanner for finding targets — a complete cybercrime assembly line.

How they beat model refusals: framing plus fresh sessions

The most informative section of the report is how the attackers handled Claude's safety refusals. The technique isn't sophisticated — it's two crude, social-engineering-style tricks:

One is context engineering: telling the agent "this is an authorized pentest on my own infrastructure," wrapping attack requests as legitimate security work. The other is session resets: when an agent in one session refused a task, the actor opened a fresh session with the authorization framing preloaded and tried again.

SOCRadar wrote a line every AI safety practitioner should memorize: "Model safety controls act on the context of a session, not on the model weights — a refusal in one session does not carry into the next."

But the report honestly records the other side: the refusal mechanism is not theater. The logs show four genuine refusals that held — the model declined to install a backdoor, disable a firewall, move laterally, and deploy a web shell; in a separate episode it refused a scan four consecutive times and correctly rejected a forged ownership token. Safety controls aren't useless; they're just consumable against an adversary willing to reopen sessions.

Bonus disclosure: another crew also writes attack code with Claude

SOCRadar's same disclosure batch included another case, "Operation Master": an adversary going by "masterblack" orchestrated a full cybercrime operation from April to mid-September 2026 — mass-scanning Palo Alto GlobalProtect gateways (CVE-2026-0257), probing SonicWall, Fortinet, Exchange, and GitLab (CVE-2023-7028 account takeover), brute-forcing WordPress logins of Japanese enterprises, and finally building an automated multi-tenant invoice-fraud platform with a cumulative 150.4 million reais in fraudulent invoices behind the tracked short links.

In SOCRadar's words, masterblack "heavily leaned on AI agents powered by Claude" to develop intrusion code and exfiltration scripts, while the operator focused on designing the fraud panel and custom C2 extenders. Recovered refusal transcripts show the operator repeatedly framing offensive development requests as authorized bug bounty or pentest activity — the same playbook, a different crew.

Four takeaways for vibe coders

First, check your own sites. This campaign names WordPress, Magento, PrestaShop, and internet-exposed Redis. SOCRadar's checklist is concrete: look for rogue WordPress administrator accounts, WSO web shells, and unexpected entries in ~/.ssh/authorized_keys on Redis hosts. If you vibe-coded a WordPress site in ten minutes and left it on the public internet unattended, it's now inside a 61-second scanner's range.

Second, the definition of "AI security" has changed. For years the term mostly meant protecting your own models and data. CyberXero is a reminder: the same agentic coding tools you use to ship faster are now in the attacker's toolkit too. A security program has to cover not just how you use AI, but how others use AI against you.

Third, the offense-defense asymmetry is widening. 4,708 targets, 429 admin panels, 32 web shells, 61 seconds. AI didn't invent new vulnerabilities — everything exploited was a known CVE. What it did was upgrade script kiddies into tireless junior pentesters. Patch windows are effectively compressed: both wp2shell CVEs have been in CISA's known-exploited catalog since July 21, 2026. If you haven't patched, you were already late.

Fourth, a structural problem for model vendors. "Safety controls act on session context, not weights" means session-level refusal mechanisms can't stop an adversary who just reopens sessions. That's not fixable with another filter — it's a structural change in the attack surface now that coding agents are standard attack components. The question Anthropic and peers must answer next: where does vendor safety responsibility end when a coding agent becomes a weapon?

One final note in a spirit VibeFix readers know well: tools aren't guilty; usage is tiered. Claude Code itself is a legitimate productivity tool, PentAGI is an open-source security research tool — the problem is the initial-access-broker business model. Just as we discussed before: reverse-engineering tools are legal while publicly cloning commercial software carries risk; AI coding tools follow the same logic. The capability is neutral; the organization that industrializes wrongdoing is the target.