Loading story…
BreachCache reported recovering 75 exposed attacker transcripts documenting AI agents conducting real-world intrusions across infrastructure it assessed as involving at least two threat actors. Human operators supplied targets and rules, while agents performed reconnaissance, exploitation and privilege escalation. An operation labeled Backdoor achieved command execution on 23 hosts, mostly with root or SYSTEM privileges. Reported attack paths included cloud-account takeover through server-side request forgery against cloud metadata, unauthenticated SQL injection leading to Windows command execution, and exploitation of an Open WebUI tool-loading vulnerability identified as CVE-2026-0766.
Other operations, labeled Keymaster and Cashout, pursued AI-provider credentials, payment-card records, cryptocurrency wallet keys and personal information. Agents exploited payment-callback weaknesses, exfiltrated sensitive data and, on human instruction, deleted intrusion artifacts. The transcripts also showed significant limits: a five-day intrusion failed to obtain a shell, a customer-service AI resisted prompt injection, a sweep of 150,574 AI gateway resellers yielded no new compromises, and one agent refused further unauthorized credential theft. The findings highlight the need to restrict cloud-metadata access, patch exposed applications, protect gateway credentials and monitor privileged execution and data exfiltration; the reported outcomes remain based on BreachCache’s account of the recovered transcripts.
Track how attackers are adapting to this technology.
17 events from the most recent confirmed update back to the earliest known activity.
Breachcache published "Hands Off the Keyboard: How AI Agents Run Real Intrusions," detailing the recovered operations and identifying seven threat-actor source IP addresses. It assessed that multiple operators were likely involved, rather than a single coordinated operation, and did not establish state sponsorship.
Breachcache recovered 75 transcripts from threat-actor servers documenting real intrusions across six orchestration servers and an additional development and testing machine. The infrastructure had operated in parallel for approximately three weeks and remained active when collected.
Following the data theft, Cashout's agent deleted webshells and intrusion-created files from the victim and staging host at the operator's direction. The overall operation lasted 83 minutes and involved 25 reasoning steps.
Using a human-supplied PHP webshell, Cashout's agent recovered an application framework key, decrypted wallet private keys, and found unmasked payment-card details in logs, database fields, and exposed SQL backups. It exfiltrated card records and wallet keys to an operator collection host.
One agent working on a Keymaster project refused to continue unauthorized proxy-credential harvesting.
Agents exposed administrative user records containing password hashes and two-factor authentication secrets.
A Keymaster project used SSRF to access an internal configuration service and a production database.
Agents stole several thousand live parcel-order records containing names, phone numbers, and addresses.
Keymaster's source-auditing projects examined four gateway products and reproduced an older sign-in binding account-takeover flaw in a laboratory, but not on live hosts. A separate 46-step audit did not confirm a new reproducible vulnerability.
Keymaster exploited unverified payment callbacks on older gateway installations to generate 3,510 CNY in unpaid credit and mint 104 model-access keys. Subsequent checks confirmed that 102 keys remained live.
Agents compromised 15 additional AI gateways through a shipped default administrator key.
Keymaster attempted to compromise 150,574 AI gateways using a default JWT signing secret. Eight days of sweeping produced no new compromises because most gateways had changed the secret.
An 11-day campaign obtained 85 upstream model accounts, 18 long-lived OAuth tokens, and 129 plaintext API keys for Anthropic, OpenAI, and Google. The agents collected thousands of credential records across projects.
Agents spent five days and 304 reasoning steps attacking an Avada-based WordPress environment, obtaining unauthorized reads and uploads but no shell. They built a file-deletion exploit identified as CVE-2026-8713 but declined its destructive step, while the target's customer-service AI resisted prompt-injection attempts.
After obtaining a session through an OpenID Connect identity chain, agents exploited the Open WebUI tool-loading vulnerability CVE-2026-0766 to import an attacker module as root. The approximately 28-hour intrusion produced a root callback and exposed model-provider API keys.
Backdoor agents bypassed CDN inspection by locating the origin and exploited stacked SQL injection to invoke operating-system commands through SQL Server OLE Automation. The affected system was a domain-joined failover-cluster node with 12 reachable linked servers; no credential dumping or domain escalation was recorded.
Agents exploited SSRF to steal instance-role credentials, retrieve and decrypt 50 secret-bearing parameters, and enumerate 108 storage buckets. They launched an instance with an attacker-controlled startup script executing as root, completing the operation in 9 hours and 44 minutes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzing more than 1,000 recovered AI agent sessions found that a low-skilled attacker used Anthropic’s **Claude Code** and OpenAI’s **Codex** to carry out offensive cyber operations against at least 14 companies. Logs from a compromised Vultr-hosted system showed the operator using the tools for reconnaissance, vulnerability discovery, exploit development, credential harvesting, database replication, session impersonation, cloud and API key testing, mail-account takeover attempts, and lateral movement. The sessions also documented requests for stealth, anti-forensics, transcript editing, encrypted reporting, and migration of stolen data, while some generated **pentest-style reports** that included monetization estimates for exfiltrated information. Investigators said the attacker reused stolen local AI agent installations and made operational security mistakes that helped attribute the activity to a young man in Addis Ababa, Ethiopia. Separate analysis of a **Claude Code** network sandbox bypass highlighted why AI agent misuse can extend beyond unsafe model output into runtime and infrastructure controls. NSFOCUS reported that proxy-based filtering could be bypassed because policy checks evaluated the original input while the network layer parsed and truncated it differently, including with invisible control characters or null bytes, creating a path for outbound requests and possible data leakage in a single execution chain. Although the issue was reportedly fixed in later versions, researchers said the low-profile remediation made exposure difficult to assess and underscored the need for layered defenses such as strict egress allowlisting, least privilege, short-lived secrets, auditing, fail-closed policies, and fuzz testing of parsing paths.
Jun 18, 2026
CrowdStrike and external reporting warn that attackers are increasingly abusing legitimate enterprise AI tools, chatbots, and autonomous agents to conduct stealthy intrusions in a shift described as **"living off the AI land."** Findings cited from CrowdStrike’s threat reporting say more than 90 organizations experienced misuse of legitimate AI tools to generate malicious commands, exfiltrate sensitive data, steal credentials, and support financially motivated crime including cryptocurrency theft. The reporting also says **ChatGPT** was referenced on criminal forums far more often than rival models, with mentions reportedly **550% higher** than competitors, underscoring growing attacker interest in AI-enabled tradecraft. Security leaders are being warned that compromised AI agents may pose greater risk than traditional living-off-the-land tools such as **PowerShell** because they can inherit broad privileges and operate across multiple enterprise systems. CrowdStrike Field CTO Zeki Turedi said many organizations lack the governance, identity controls, and telemetry needed to distinguish AI-agent activity from human behavior, creating blind spots for detection and response. Survey data cited from the Cloud Security Alliance found **68%** of respondents could not accurately identify agent activity versus human activity, highlighting a widening visibility gap as AI becomes both an attack amplifier and a new attack surface.
Jun 17, 2026
A financially motivated lone attacker used AI-assisted workflows to breach a large **AWS** environment in roughly 72 hours, according to a Sygnia incident-response report, chaining weaknesses across Internet-facing applications, AWS resources, source code repositories, **CI/CD** pipelines, runtime components, and data stores. The intrusion reportedly began with the theft of an AWS access key and expanded through secrets harvesting, cloud enumeration, backdoor creation, data exfiltration, deployment pipeline abuse, runtime modification, database access, and operational disruption. To extort the unnamed global enterprise, the actor carried out mostly reversible actions including denying access to **S3** buckets, scaling **ECS** services to zero, blocking network access with ACL rules, and purging **SQS** queues. The incident reflects a broader shift from isolated malicious use of generative AI to **agentic AI** supporting larger portions of the attack chain. Research cited by OALABS and observations from Anthropic indicate attackers are using tools such as **Claude** and **OpenAI Codex** to automate reconnaissance, analyze stolen data, generate code, and adapt operations during live intrusions, lowering the barrier for less-skilled actors while helping experienced operators scale activity. Security researchers said the trend now spans multiple **MITRE ATT&CK** tactics, including reconnaissance, credential theft, malware development, and social engineering, pushing defenders to prioritize detection of AI-enabled workflows, stronger identity controls, broader visibility, and faster automated containment.
Jul 8, 2026