Inexperienced attacker uses artificial intelligence robots to breach the systems of 14 companies
The ability of virtual assistants based on artificial intelligence to bypass cybersecurity systems is no longer new in the technology sector. Complex activities such as code scanning, vulnerability mapping and creating malicious scripts, previously exclusive to experts, can now be replicated by advanced algorithms. The main obstacle to this chaotic scenario are the security locks built into large language models (LLMs), but these barriers do not always operate as effectively as desired. A document released in June detailed exactly one of these failures, showing how an individual with very limited technical knowledge managed to compromise the corporate networks of at least fourteen different organizations.
Despite the gravity of the situation, this specific event does not rank among the biggest information leaks in digital history. The identification of the attack occurred thanks to the meticulous work of OALABS, a collective specializing in malware investigation, which gained full access to the criminal’s file folder, where all interaction histories with automated platforms were stored. The researchers compiled the data, cross-referenced the information and published the results of this in-depth analysis in a dossier at the end of the first semester.
In an attempt to hide his digital tracks and avoid criminal prosecution, the cybercriminal chose not to run the programs on his own personal computer. The chosen strategy was to host the applications on a third-party server that he had already hacked months before. The attacker’s big mistake was that this machine belonged to a close contact of the OALABS team of experts. Upon noticing the strange movement and unusual consumption of processing on his system, the server owner copied the attacker’s entire operations directory and passed the material directly to security analysts.
More on this story: ChatGPT receives improvements in August: GPT-5.6 brings robustness and security focus to everyone
Within the recovered files, researchers found more than a thousand interactions recorded with Claude Code, developed by Anthropic, and Codex, created by OpenAI, both advanced autonomous programming systems capable of running commands directly on the terminal. As the two assistants operated locally on the compromised machine, the logs preserved detailed data, including phrases typed, system requests and even the line of logical reasoning adopted by the machines before each action. One detail that caught the experts’ attention was the low quality of the texts entered by the user, full of confusing instructions and primary spelling errors.
Strategies used to bypass algorithm security blocks
Most modern virtual assistants have strict filters against malicious use, but in this episode, the protection only worked partially and inefficiently. During hacking attempts, Claude blocked suspicious requests on nine occasions, while Codex only blocked one direct request. To circumvent these restrictions, the criminal used a social engineering tactic against the machine itself, claiming that he was conducting an “authorized red team exercise” — a legitimate practice in the corporate market where security professionals simulate attacks to test the defenses of a contracting company. This same trick of pretending to be an ethical bounty hunter was recorded earlier this year during a theft of government information in Mexico.
After deceiving the platform’s ethical filters, the user provided a list of the victims’ IP addresses and sent an extremely basic command requesting recognition of the network. From that moment on, the Anthropic system took control and executed a sequence of tactical actions autonomously:
- It mapped which ports and corporate services were exposed and accessible via the internet.
- Searched for documented loopholes in public cybersecurity repositories.
- Wrote the custom exploit scripts to break into the vulnerable machines.
- Extracted sensitive files and data from servers silently.
The robot’s efficiency was such that it produced individual reports on each compromised target, including calculating the estimated financial value of the stolen material to facilitate accounting for the crime.
See Also
Electrical discharge knocks man off roof in Jaguaruana after contact with power lines
Global auction raises US$11.9 million and Brazil’s historic currency reaches record value
Former fighter Prichard Colón dies at age 33 after decade in a vegetative state
In a later stage of the attack, the individual ordered the tool to classify the hacked companies based on the profit potential they could generate in a possible ransom request. Responding to the request, the algorithm not only organized the list of priorities, but also suggested different criminal approaches to transform illegal access into cash, highlighting direct extortion as the fastest and most profitable route.
Digital traces reveal the true identity and lack of preparation of the cybercriminal
The amateurism of the author of the attack was evident on several fronts, starting with the fact that the version of Claude installed on the server was a pirated copy obtained from a programmer in the Czech Republic. The lack of care for his own operational security was what sealed his fate and exposed his personal life. In the first interactions with artificial intelligence, the user asked the robot to review his professional CV, a document that contained his birth name, academic history and a direct link to his LinkedIn page. The OALABS team even suspected that the information was a trap designed to mislead investigators, but subsequent data crossings confirmed that the identity was completely real.
Learn more: OpenAI presents GPT-5.6-Cyber, artificial intelligence for digital protection
Panic also took over the attacker during the clandestine operation. Believing that his temporary infrastructure was being counterattacked by another entity, he requested that the virtual assistant list all IPs connected to the machine at that exact moment. This accidental scan ended up recording in the logs the broadband residential internet addresses that he himself was using, located in the city of Addis Ababa, capital of Ethiopia.
Even with the help of cutting-edge technologies and dozens of compromised targets, there is no evidence that the Ethiopian managed to profit a single cent from the operation. During the exploration, he managed to access a server that functioned as a Lightning Network node — a secondary layer of Bitcoin designed to accelerate financial transactions. The virtual wallet hosted on this equipment held 69.71 BTC, an amount that exceeds the 4 million dollar mark at the current exchange rate. However, the fortune remained untouchable, as the file containing the private access keys was heavily protected by high-level encryption.
A crucial point highlighted in the security report is that the versions used in the attack, identified in the logs as Claude Opus 4.5 and GPT-5.2, do not represent the most recent and secure editions of these platforms. The most obvious answer to mitigating this type of threat in the future would be to calibrate algorithms to reject ambiguous commands more rigorously and strengthen their ethical barriers against social engineering. However, OALABS researchers warn that tightening these restrictions too much can have a negative side effect, hindering and delaying the daily work of legitimate cybersecurity analysts who rely on these same tools to protect corporate infrastructures against real threats.
