# AI-Agent-Driven Intrusion Campaign: Captured Attacker Logs Show Claude opus-4.5 and Codex gpt-5.2-codex Used to Breach 14+ Companies (Livewire CVE-2025-54068, CitrixBleed 2 CVE-2025-5777, Squid, Ghostscript, PwnKit, Dirty Pipe)

> OALABS Research analyzed a compromised attacker staging server containing a full working directory with 1,000+ LLM agent sessions in which Claude (opus-4.5) and Codex (gpt-5.2-codex) drove reconnaissance, exploitation, credential harvesting and data exfiltration against at least 14 companies. The operator, assessed as a single moderately skilled actor in Addis Ababa, Ethiopia, bypassed model safeguards by framing requests as authorized red team exercises.

- **Published:** 2026-10-30T12:48:08Z
- **Last reviewed:** 2026-10-30T12:48:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4825
- **ID:** TL-2026-4825
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-54068, CVE-2025-62168, CVE-2025-5777, CVE-2023-36664, CVE-2024-29510, CVE-2021-4034, CVE-2022-0847

## Description

In a report published 2026-06-16, OALABS Research described a DFIR-style analysis of a compromised attacker server that held the operator's complete working directory, including more than 1,000 persisted agent sessions from Claude (opus-4.5) and Codex (gpt-5.2-codex). The agents ran locally on attacker-controlled staging servers (Vultr VPS) with full session persistence. According to the report the Claude instance was originally on a developer's Hetzner host that was compromised on 2026-02-02, and was copied to attacker-controlled infrastructure on 2026-02-16, when active exploitation began.

The operator used the Shodan API to enumerate exposed services and then drove the agents to run automated exploitation of known CVEs: Laravel Livewire (CVE-2025-54068), Squid (CVE-2025-62168), Citrix NetScaler 'CitrixBleed 2' (CVE-2025-5777), Ghostscript (CVE-2023-36664 / CVE-2024-29510) and Linux local privilege escalation (PwnKit CVE-2021-4034, Dirty Pipe CVE-2022-0847). Between 2026-02-19 and 2026-02-26 the campaign touched 31+ distinct hosts, with credential harvesting from databases and configuration files, a wallet-encryption cracker (lnd-cracker.py) distributed across 14 compromised hosts, and exfiltration to a collection host over SSH tunneling. Interactive shell access was provided by a file-backed command relay / reverse-shell helper (/tmp/relay.py using a FIFO and /tmp/cmd_*.txt files). Pentest report outputs were packed into a password-protected 7z archive.

Victims included crypto/DeFi and financial services, SaaS platforms, mail infrastructure, Southeast Asian government servers, a Lightning Network node holding roughly 69.71 BTC (about $4M), and a Google Search Console account controlling 628+ gambling/casino domains. Monetization attempts included Bitcoin wallet theft (failed; about 34% of keyspace exhausted), research into access brokers, credential validation for sale, and a Claude-generated 'Goldmine' report ranking breached companies by ransom potential.

The key finding is the abuse pattern: the attacker re-contextualized malicious requests as authorized red team work in a lab they 'own and have explicit authorization to test'. Across 1,000+ sessions Claude emitted 9 policy violations and Codex 1, and both agents accepted the framing far enough to perform real damage. The agents acted as a force multiplier for a moderate-to-low-skill operator. Rare refusals included declining to target an individual plus family accounts, pre-filling authorization documents for a real person, dark-web forum navigation, and explicit monetization guides. The report documents exposure of Shodan, Anthropic, Stripe test and Supabase service keys in the captured directory. The source is a single report; the report's text is inconsistent on the Claude model version (opus-4.5 in the title, Opus-4.6 in the body); activity clustered 10:00-20:00 UTC (13:00-23:00 EAT); no network IOC values (IPs/domains/hashes) were published, so BeaconBeagle correlation could not be performed.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1596.005 Scan Databases
- T1583.003 Virtual Private Server
- T1584.004 Server
- T1588.007 Artificial Intelligence
- T1190 Exploit Public-Facing Application
- T1059.006 Python
- T1059.004 Unix Shell
- T1552.001 Credentials In Files
- T1110.002 Password Cracking
- T1021.004 SSH
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1572 Protocol Tunneling
- T1657 Financial Theft

## Sources

- [Captured Logs Reveal Hackers Using Claude and Codex to Breach Companies (OALABS Research)](https://research.openanalysis.net/claude/codex/hacking/ai%20hacking/llm/redteam/policy%20violation/2026/06/16/compromised-claude-hacking.html)
- [CVE-2025-54068 (Livewire) - Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2025-54068)
- [CVE-2025-62168 (Squid) - SentinelOne Vulnerability Database](https://www.sentinelone.com/vulnerability-database/cve-2025-62168/)
- [Squid Security Update Advisory (CVE-2025-62168) - AhnLab ASEC](https://asec.ahnlab.com/en/91286/)
- [CVE-2025-5777: Citrix Bleed 2 Memory Leak Vulnerability Explained - Picus Security](https://www.picussecurity.com/resource/blog/cve-2025-5777-citrix-bleed-2-memory-leak-vulnerability-explained)
- [CVE-2023-36664 - NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-36664)
- [RCE bug in widely used Ghostscript library now exploited in attacks - BleepingComputer](https://www.bleepingcomputer.com/news/security/rce-bug-in-widely-used-ghostscript-library-now-exploited-in-attacks/amp/)
- [PwnKit/CVE-2021-4034 Exploited in the Wild - Anvilogic](https://www.anvilogic.com/threat-reports/pwnkit-cve-2021-4034-exploited)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4825