The potential for machine learning-based virtual assistants to circumvent cybersecurity systems is no longer just a theory. Complex activities such as vulnerability scanning and creating malicious scripts can now be performed by advanced algorithms. Although technology companies implement guardrails in large language models (LLMs), these guardrails demonstrate instability. A recent technical document revealed that a flaw in these restrictions allowed an individual without advanced programming knowledge to compromise the infrastructure of at least fourteen different organizations.
Despite the number of targets, the event does not appear on the list of the biggest information leaks in digital history. The attack was identified thanks to the work of OALABS, a team specialized in analyzing malicious software, which gained full access to the cybercriminal’s operational files. This database contained the complete history of the attacker’s interactions with automated systems, resulting in a detailed dossier published by the researchers in the middle of the year.
More on this story: Inexperienced attacker uses artificial intelligence robots to breach the systems of 14 companies
In an attempt to hide his digital identity, the author of the attacks avoided using his own computers to run the scripts. The strategy adopted was to host the applications on a third-party server that he had previously mastered. What the attacker did not anticipate was that the machine belonged to a close contact of OALABS experts. Upon noticing the suspicious movement, the owner of the equipment copied the criminal’s entire file folder and passed the material on to the security team for analysis.
The recovered material contained more than a thousand records of conversations with Claude Code, developed by Anthropic, and Codex, created by OpenAI, both operating as autonomous agents capable of running codes directly on the machine. Because the programs were configured in a local environment, the logs stored detailed data, including the exact commands entered, system requests, and the machine’s processing logic. One detail that caught the attention of analysts was the low quality of the instructions sent, full of ambiguities and primary spelling errors.
Learn more: ChatGPT receives improvements in August: GPT-5.6 brings robustness and security focus to everyone
Strategies adopted to overcome the barriers of virtual assistants
Most current generative models rely on ethical filters, but in this episode, their effectiveness was limited. Records show that the systems even warned about breaches of guidelines: Claude blocked orders on nine occasions, while Codex only blocked one attempt. To circumvent these defenses, the malicious user used social engineering against the machine itself, claiming that it was conducting an authorized intrusion test (known in the corporate market as “red team”). This method of tricking the algorithm is identical to that recorded earlier this year, when cybercriminals claimed to be participating in a bounty hunting program to steal government information in Mexico.
After convincing the system of his false intentions, the operator provided a list of IPs and sent an extremely generic order to begin recognition. From this simple command, Claude took control of the operation by performing the following tasks:
- Mapped all corporate services that were exposed to the public internet.
- Performed automated searches for documented flaws in security repositories.
- Wrote and executed the exploit codes necessary to break into the machines.
- It extracted confidential files and generated a balance estimating the value of the data on the underground market.
In a later stage of the attack, the individual demanded that the virtual assistant classify targets based on the profit potential obtained through ransoms. In response to the request, the platform generated a detailed action plan with different monetization tactics, including suggesting methods of direct extortion against the executives of the hacked companies.
On the same topic: OpenAI presents GPT-5.6-Cyber, artificial intelligence for digital protection
Digital traces reveal the attacker’s lack of technical preparation
The operational errors committed during the campaign made clear the author’s lack of experience in the cyber underworld. The version of Claude used was an unlicensed copy, obtained from a programmer in the Czech Republic. The biggest mistake, however, occurred in the first interactions: the criminal asked the artificial intelligence to review his own professional resume. The document contained his birth name, academic history and a direct link to his LinkedIn page. Although OALABS initially suspected a trap to frame an innocent person, subsequent investigations confirmed that the data did in fact belong to the operator.
The amateurism became even more evident when the hacker himself believed that his temporary infrastructure was suffering a cyber attack. In a panic, he ordered the algorithm to list all IPs connected to his server. The result of this scan exposed its true location, revealing connections originating from residential internet providers located in the city of Addis Ababa, the capital of Ethiopia.
Even compromising dozens of networks, analyzes indicate that the Ethiopian was unable to convert the invasions into money. The most lucrative opportunity came when he accessed a Lightning Network node, a secondary transaction layer of the Bitcoin network. The digital wallet hosted on the machine held 69.71 BTC, an amount valued at around 4 million dollars. However, a lack of advanced cryptography knowledge prevented the theft, as the file containing the private keys was locked by complex passwords.
The researchers highlight that the versions explored in the incident were Claude Opus 4.5 and GPT-5.2, editions that no longer represent the state of the art of the respective companies. The technology industry’s immediate response would be to tighten security filters to block any suspicious prompt. However, OALABS warns that an excessively strict blockade would cause a serious side effect: it would harm the work of auditors and information security experts who rely on these same tools to legitimately test and protect corporate networks.