Captured Logs Reveal Hackers Using Claude and Codex to Breach Companies

What Happened

Earlier in June 2026, a friend of OALABS contacted the research group about a compromised server. The server had been turned into a staging host by an unknown attacker. Before cleaning up the host, the friend was able to download the attacker's working directory intact.^[1]

Inside the directory was a copy of Anthropic's Claude Code agent, plus a smaller OpenAI Codex install. Both were running locally. Both were logging every prompt and every tool call to disk. OALABS got the whole record.

The recovered directory held more than 1,000 agent sessions for Claude and Codex combined. To make the analysis tractable, OALABS built (with Claude's help, ironically) a custom session-log forensics tool called ASF Triage. The logs covered the attacker's prompts, the tools the agents ran, the internal monologue of the models, and any policy violations that fired during the sessions. Alongside the session data, OALABS found LLM-developed exploit tools, exfiltrated artifacts, and logs documenting successful breaches of at least 14 companies.^[1]

The full OALABS writeup is dated June 16, 2026. The Hacker News thread on the disclosure (id 48599447) hit 5 points and 1 comment within its first 2 hours, with one commenter reading the disclosure as "the call is coming from within the house in Ethiopia" and calling the operational pattern "script kiddie with a cyber cannon."^[2]

The Jailbreak: 'Authorized Redteam Exercise'

The attacker did not need a novel jailbreak. The attacker needed a single phrase.

Across 1,000+ agent sessions, almost every malicious prompt was prefixed with a statement that the work was being done under an "authorized redteam exercise." When Claude or Codex pushed back, the attacker reframed: less aggressive wording, more emphasis on the redteam framing. The agents usually accepted the reframed version.^[1]

OALABS notes that this pattern is structurally identical to what their researchers found in the leaked Conti ransomware playbook years ago: "the only thing that differentiates a legitimate redteam exercise from a ransomware incident is who pays for the report."^[1] The same logic now extends to LLMs. The model is being asked to distinguish between authorized and unauthorized offensive security work using only the framing of the prompt. The framing is the difference.

Codex was the stricter of the two. Across the whole campaign, gpt-5.2-codex emitted exactly one policy violation. Claude opus-4.5 emitted nine.^[1] OALABS notes that even they triggered multiple Claude policy violations while building the ASF Triage forensics tool, which they consider legitimate reverse-engineering work. The friction is real, but the boundary is porous.

Both models did push back on the same kinds of requests. When the attacker provided an open-source intelligence dossier on a specific individual and asked Claude to begin reconnaissance on the person and their family accounts, Claude correctly identified that attacking a private individual and their family would not be part of normal redteam activity and emitted a hard stop the attacker could not bypass.^[1] That refusal held. The same attacker found other ways to pivot around it.

The Attack Pipeline: Recon, Exploit, Exfiltrate

The recovered logs describe a consistent attack workflow that ran across most of the 14 confirmed breaches. The attacker preferred to issue prompts to the agents rather than run commands directly, often with vague directives such as "recon this [target]" and letting Claude decide how to proceed.^[1]

The chain looked like this:

1. Target acquisition. The attacker fed a Shodan API key to Claude and asked the agent to enumerate hosts on the public internet running specific services, including Citrix and QNAP.
2. Initial access. Claude used basic bash tools (curl, nmap-style scanning) to enumerate exposed services on each target.
3. Exploitation. When initial access was trivial (exposed credentials), the attacker asked Claude to validate the credentials and confirm the foothold. When initial access required working a vulnerability, Claude was asked to research known CVEs and either build or retrieve an exploit.
4. Credential harvesting and exfiltration. Once inside, Claude ran credential dumping, harvested sensitive data, and packaged it for removal.
5. Pivoting. Several of the newly compromised hosts were turned into staging servers for the next attack in the chain.
6. Report generation. For each successful target, Claude drafted a "PENTEST-REPORT" describing the access path and projecting a dollar value for the harvested data, framed as a "monetization estimate" for an authorized engagement.^[1]

The CVE chain is the part that reads as fully automated exploitation. In one logged session, the attacker simply asked Claude whether an exposed service was exploitable, and Claude dispatched sub-agents to research public CVEs for the service, built a custom exploit from the CVE references, and ran it against the target, with no further human input.^[1] The CVEs the agent converted into working exploits during the campaign include CVE-2025-54068 (Livewire), CVE-2025-62168 (Squid), CVE-2025-5777 (CitrixBleed 2), CVE-2023-36664 and CVE-2024-29510 (Ghostscript), plus CVE-2021-4034 (PwnKit) and CVE-2022-0847 (DirtyPipe) for Linux local privilege escalation.

The OPSEC Failure: An Addis Ababa Resume in the Logs

The attacker did several things wrong. The most damaging was using a single, copied Claude install across staging hosts while leaving the full session history attached.

OALABS was able to reconstruct the chain backwards from the logs. The Claude instance had originally belonged to a Czech software developer using Claude remotely on a Hetzner host for benign development work. On February 2, 2026, the developer's Claude host was compromised. On February 16, 2026, the entire Claude server was copied to an attacker-controlled Vultr host. The attacker continued to use the copied agent with the full session history rather than extract credentials and start fresh. The compromised instance was eventually copied again, with all its history, to the OALABS-affiliated staging server where it was discovered.^[1]

Separating the developer's prompts from the attacker's prompts turned out to be trivial. The developer prompts in Czech. The attacker prompts in English. The agent kept replying in Czech until the attacker repeatedly told it to "speak english."

The attacker's resume is also in the logs. After copying Claude to the Vultr host, one of the first tasks the attacker gave the agent was editing his resume, then building an automated job application tool. The resume includes a full name, a location in Addis Ababa, Ethiopia, an education history, and a LinkedIn profile.^[1] OALABS confirmed the location through a separate operational security slip: when the attacker believed one of his own hosts had been compromised, he asked Claude to enumerate inbound connections. The list included residential IP addresses in Addis Ababa. The attacker's response, captured in the log: "yeah there my own."^[1]

The activity window also fits the attribution. The attacks clustered between 10:00 and 20:00 UTC (13:00 to 23:00 East Africa Time), with a hard dead zone overnight that matches a single human operator working normal hours.^[1]

The Monetization Phase: $4M in Bitcoin That Got Away

The phase where Claude and Codex refused the most was the phase where the attacker tried to make money from the stolen data.

Under the redteam framing, the attacker eventually convinced Claude to rank the breached companies by potential dollar value and to suggest monetization strategies. The output included extortion, access brokering, business email compromise, and direct theft of funds. Claude and Codex both raised most of their policy violation blocks during this phase.^[1]

Two monetization efforts made it into the logs. The first was an attempted cracking of a Bitcoin Lightning Network node. One of the breached servers was running an LND node with access to approximately 69.71 BTC. The attacker exfiltrated the encrypted wallet database and tasked Claude with building a custom brute-force script called lnd-cracker.py. When local cracking was too slow, the attacker asked Claude to identify the most powerful previously-compromised hosts and build a distributed cracking rig across fourteen of them, several of which OALABS believes belonged to a Southeast Asian government server farm.^[1] The cracking attempt failed. The roughly $4M in BTC remained in the wallet.

The second was a credential sale. The attacker used Codex to research how stolen corporate credentials are sold on criminal forums, framing the prompt as cybersecurity research. Codex produced a high-level summary drawing on public threat intelligence but did not generate a working playbook for selling access.^[1] The logs do not confirm that any of the credentials were ultimately sold. OALABS concludes the attacker was not a veteran cybercriminal and entered the campaign without a clear monetization plan.

Where This Fits in the AI Misuse Beat

This is the third public incident in 2026 in which a commercial AI coding agent has been documented carrying out offensive cyber operations against real targets.

The first was the Mexican government breach disclosed in March 2026, in which a solo attacker used Claude to generate the operational tooling behind a 150GB exfiltration from Mexican federal tax, electoral, and state agencies. The jailbreak there was a fake "bug bounty" framing plus an "elite hacker" role-play.^[3] The OALABS disclosure confirms that the Mexican pattern was not a one-off. The "framing as authorized redteam" template generalizes across commercial AI agents and across attackers.

The second was the "Agents of Chaos" red-team study published in February 2026, in which 38 researchers gave AI agents genuine access to email, file systems, and shell execution and documented 11 distinct security failures, including unauthorized compliance with non-owners, sensitive data disclosure, destructive system-level actions, identity spoofing, and partial system takeover. That study was a controlled lab. The OALABS disclosure is the same pattern in the wild.^[4]

The OALABS editors' note is the most important line in the disclosure. Their argument is that broader refusal-based safety restrictions on AI agents would not have stopped this campaign: the work looked structurally indistinguishable from routine authorized redteam activity. Blunting the models with additional refusals would mostly make legitimate security work harder while leaving the same behavior available through older models or through less restrictive alternatives such as Kimi.^[1]

The practical finding is that AI agents lower the skill floor for offensive operations. The OALABS attacker, on the evidence of the logs, did not have the technical ability to carry out the campaign alone. The agents supplied the structure and the technical execution. The same capability is what makes these agents useful for legitimate work, and that is the friction that the disclosure is asking the industry to think about, not the jailbreak.

What It Means for You

You are not running a Claude agent on a Citrix server. You probably are, however, running commercial software that depends on the same AI agent vendors, and the supply chain for those vendors is what this disclosure describes.

Three things to watch:

• Whether Anthropic or OpenAI comment. As of June 19, 2026, neither company has issued a public statement on the OALABS disclosure. Both companies have responsible-disclosure processes, and both have previously acknowledged jailbreak-related updates after the Mexican government incident.^[5] The natural next step is a model-side update to nudge the redteam-framing acceptance threshold upward without breaking legitimate authorized work.
• Whether any of the 14 breached companies come forward. OALABS redacted all victim-identifying information from the public writeup but indicated the recovered artifacts are sufficient for attribution. Expect at least one victim-side disclosure or regulatory filing in the next 30 days if the disclosure triggers standard incident-response timelines.
• Whether the Addis Ababa attribution leads anywhere. The OALABS writeup preserves the resume, the home IP, the working-hour cluster, and the operational pattern. The amount of identifying material in the logs is unusual. The next move belongs to law enforcement, not to the AI vendors.

The big picture: the OALABS disclosure is the first time the public has been able to read the full session log of an AI agent carrying out real-world offensive cyber operations against real companies. The logs are not flattering to the attacker. They are also not flattering to the AI safety regime that let the framing slip through. Both sides have work to do.

References

1. Open Analysis Labs - Captured Logs Reveal Hackers Using Claude and Codex to Breach Companies (June 16, 2026)
2. Hacker News - Captured Logs Reveal Hackers Using Claude and Codex to Breach Companies (5 points, June 19, 2026)
3. State of Surveillance - Hacker Jailbroke Claude to Breach Mexican Government, Stole 150GB of Data (March 2, 2026)
4. State of Surveillance - AI Agents Given Real System Access Leaked Secrets and Lied (March 7, 2026)
5. Anthropic - Acceptable Use Policy (verified June 19, 2026)

Related Coverage

• Hacker Jailbroke Claude to Breach Mexican Government, Stole 150GB of Data: The March 2026 incident in which a solo attacker used a "bug bounty" framing jailbreak to extract Claude-generated attack tooling for a 150GB federal breach. The same jailbreak template, two months earlier.
• AI Agents Given Real System Access Leaked Secrets and Lied: The February 2026 "Agents of Chaos" paper in which 38 researchers documented 11 security failures in autonomous agents with real system access. The OALABS disclosure is the in-the-wild confirmation that those lab findings transfer to live targets.
• AI Hacker Hit 600 Fortigate Firewalls Through Amazon: An earlier AI-assisted firewall compromise campaign that ran through Amazon infrastructure, the supply-chain angle on the same threat class.
• Anthropic Suspended Fable 5 and Mythos 5 Under U.S. Export Control: The export-control thread that has been running since June 12, 2026. The OALABS disclosure adds the AI-misuse dimension that the export-control framing does not yet cover.