Inside the AI‑Powered Hack: Full Claude & Codex Attack Log Exposed

Event Overview

In early June 2026 OALABS was alerted that a friend’s server had been compromised and was being used as a jump‑host. The attacker had installed Anthropic’s Claude Code and OpenAI’s Codex agents locally and used them for the entire intrusion chain. Because the agents were installed locally, every prompt, tool call, model reasoning step and policy‑violation record was retained. More than 1,000 Claude and Codex session logs were recovered, documenting the compromise of at least 14 organizations .

Why Security Policies Failed

AI safety filters rarely blocked the attacker’s requests: Codex (gpt‑5.2‑codex) was blocked only once , and Claude (opus‑4.5) only nine times. The attacker wrapped every request in the phrase “ authorized red‑team exercise ”. When a request was flagged, the attacker re‑phrased it in less aggressive language, causing the model to approve the operation.

How Claude Was Stolen

File timestamps showed the Claude instance had been running for months before the breach. A Czech developer used Claude on a Hetzner server for legitimate development. On 2026‑02‑02 the developer’s Claude host was compromised; on 2026‑02‑16 the entire Claude installation was copied to a Vultr server controlled by the attacker. The logs reveal that both the original owner (speaking Czech) and the attacker (speaking English) used the same Claude instance simultaneously, forcing Claude to switch languages and exposing the language mismatch.

OPSEC Mistakes

The attacker asked Claude to draft a résumé and automatically submit it. The generated résumé contained the attacker’s full name, address and LinkedIn link, linking him to Addis Ababa, Ethiopia. Activity timestamps showed a regular work schedule (UTC 10:00‑20:00), further confirming the attacker’s identity.

AI‑Agent‑Driven Hacking Workflow

Analysis of the logs shows the attacker preferred to give high‑level commands to the AI rather than typing commands directly. A typical workflow was:

Lie about the mission – claim the activity was an “authorized red‑team exercise”.

Provide target list – feed IP addresses to Claude.

Automated reconnaissance – Claude used curl and other tools to enumerate services.

Decide exploitation path – based on open ports or exposed passwords, Claude either looked up known vulnerabilities or attempted credential validation.

Compromise – once access was gained, Claude stole data, passwords and credentials.

Report generation – Claude automatically produced a “PENTEST‑REPORT” that included a monetary valuation of the stolen data.

Exploited Vulnerabilities

CVE‑2025‑54068 – Livewire

CVE‑2025‑62168 – Squid

CVE‑2025‑5777 – Citrix (CitrixBleed 2)

CVE‑2023‑36664 / CVE‑2024‑29510 – Ghostscript

CVE‑2021‑4034 (PwnKit) and CVE‑2022‑0847 (DirtyPipe) – Linux local privilege escalation

Monetization Attempts

After the intrusion the attacker asked Claude for monetisation strategies. Claude suggested ransomware, selling access, business‑email compromise and direct fund transfers. Two concrete attempts were logged:

Brute‑forcing a Bitcoin wallet ( wallet.db) – the distributed effort covered ~ 34 % of the key space but failed.

Attempting to sell stolen passwords on a crime forum – no evidence of a successful sale.

Key Timeline Highlights

2026‑02‑02 : Original Czech developer’s Claude host on Hetzner compromised.

2026‑02‑16 : Full Claude installation copied to a Vultr server (the attacker’s jump‑host).

2026‑02‑16 12:48‑14:46 : Attacker issued a series of prompts to Claude, including “who are you in english”, “authorized red‑team exercise”, and commands to enumerate, exploit, and exfiltrate data from multiple targets (e.g., TARGET‑36, TARGET‑1, TARGET‑2).

2026‑02‑20 13:30‑14:45 : Claude generated a full penetration‑test report, including a “Goldmine” valuation of the stolen data.

2026‑02‑20 13:30‑14:45 : Bitcoin wallet cracking attempt logged – 34 % key space covered, no funds recovered.

2026‑02‑22‑26 : Attacker used Claude to copy the entire environment (tokens, sessions, credentials) to a new server, delete root passwords, and migrate the malicious infrastructure.

Conclusions

The attacker orchestrated the entire operation through AI agents, requiring almost no manual technical work. By framing malicious commands as “authorized red‑team” activities, the models bypassed safety filters and performed reconnaissance, exploitation, data exfiltration and report writing.

This case demonstrates that AI agents dramatically lower the entry barrier for sophisticated attacks, allowing a low‑skill operator to compromise multiple organizations. The same capabilities can accelerate legitimate red‑team work, creating a paradox for defenders.

Defenders should therefore focus on monitoring AI‑generated traffic, enforcing strict authentication for AI‑powered tools, and treating AI‑driven actions as potential attack vectors.