The model's refusals held. The attacker reset the session.

SOCRadar has disclosed details of an AI-augmented intrusion campaign run by a Russian-speaking, financially motivated initial access broker it calls CyberXero, active since at least July 2026. The Hacker News reported the findings last week. The campaign ran two pipelines at once: a global automated sweep of WordPress and e-commerce sites, and a curated manual campaign against Ukrainian energy and critical infrastructure.

The numbers are concrete. SOCRadar estimates confirmed exfiltration from four Ukrainian organizations, with more than 628,000 records tied to Ukrainian individuals in the actor's possession, including residents of Kharkiv. Confirmed compromises also turned up in Poland, China, and the Netherlands. One automated execution, captured in the recovered data, scanned 4,708 targets, gained access to 429 WordPress admin panels, and deployed 32 web shells in a 61-second window. This is the real-world case for the argument Talos made last week: agentic attacks are loud by choice, not by necessity (the analysis). The directed campaign probed Ukrainian energy and utilities, including a heating provider in Kharkiv.

The AI layer is the part that will get attention, and it deserves careful description. CyberXero ran 51 specialized Claude Code agents on its primary workstation for scanning, exploit chaining, reconnaissance, and post-exploitation, with tasks parcelled out by complexity. Separately, the crew wired PentAGI, an open-source AI pentesting framework, into a Cobalt Strike Team Server through an AI provider API for payload generation and execution. This is AI as an operational layer around commodity offensive tooling, not an autonomous attacker. The exploits were familiar ones: wp2shell (CVE-2026-63030 and CVE-2026-60137), an SQL injection in the Support Board WordPress plugin (CVE-2026-4815), exposed Redis servers.

What the session logs show about model safety is the most useful finding in the report, and it cuts both ways. When agents refused, the actor used context engineering and session resets, preloading a fresh session with the framing that this was an "authorized pentest on my own infrastructure," and tried again. SOCRadar's line is precise: safety controls act on the context of a session, not the model weights, so a refusal in one session does not carry into the next.

But the logs also record genuine refusals that held. Across iterations, the model declined to install a backdoor, disable a firewall, move laterally, and deploy a web shell. In a separate episode it refused a scan four consecutive times and correctly rejected a forged ownership token. The guardrails were not useless. They were session-bound, and the attacker had infinite fresh sessions.

How was the campaign exposed? Not by detection of the AI layer. An exposed open directory at 46.21.250[.]135 leaked the actor's live working directory: per SOCRadar, more than 90,000 files, including AI session logs, scripts with plaintext tokens, exploitation toolkits, reconnaissance output, agent configurations, and exfiltrated victim data. The classic OPSEC failure did what no agent-monitoring system did. The campaign remains ongoing, per SOCRadar.

For defenders, the report carries concrete indicators. The wp2shell tool creates a WordPress administrator account whose username matches wp2_ followed by eight hexadecimal characters; that pattern is a compromise signal, not a legitimate user. Organizations running WordPress, Magento, or PrestaShop, or exposing Redis to the internet, should check for rogue WordPress administrators, WSO web shells, and unexpected entries in ~/.ssh/authorized_keys on Redis hosts.

Two lessons land. First, do not treat a model's refusal as a control. It is a speed bump that resets with the session. Second, the campaign's weak point was never the AI. It was credentials in plaintext, an open directory, and unpatched plugins. The familiar failures are still doing most of the damage, and they match the year's other agent-overreach incidents, including the rogue agents that may have knocked part of Wikipedia offline (details). The AI just made the familiar failures faster.