One operator. Up to 51 coordinated Claude Code agents in recon, exploitation, and exfiltration roles. A single automated run that scanned 4,708 targets, confirmed 429 WordPress admin panels, and deployed 32 webshells in 61 seconds — that's the CyberXero campaign documented by SOCRadar, active since July 2026, leaving the data of more than 628,000 individuals in one operator's hands. Below: the five telltale coordination patterns from the report, then an 8-question check of your own fleet. Free, no signup.
Answer for the agent fleet YOU operate. Here, "Yes" is the safe answer — it means the control exists.
Defensive self-assessment based on the publicly reported SOCRadar CyberXero findings (October 2026). Informational only — it is not a security guarantee, and not legal or compliance advice. Figures cited: up to 51 agents, 4,708 targets scanned, 429 WordPress admin panels, 32 webshells in 61 seconds, active since July 2026, 628,000+ individuals, 90,000+ exposed files, indicators wp2_+8hex admin accounts and wp2shell_+8hex plugins — all per the SOCRadar report.
By looking for coordination, not malware. A swarm of AI agents leaves behavioral fingerprints: synchronized API calls, shared infrastructure, recon-exploitation-exfiltration role patterns, and timing no human team matches. The detector scores your logs across eight signals. One operator running 51 agents looks nothing like 51 humans — the math gives it away.
A free 8-question defensive self-assessment that checks whether your agent fleet has the eight controls that would have made the CyberXero swarm attack impossible — or at least visible. Informational only; not a security guarantee.
Burst-rate spikes across agents (CyberXero: 32 webshells in 61 seconds); identical target lists in one window (4,708 targets scanned in one run); shared phrasing across session logs; refusal-then-reframe sequences in fresh sessions; and coordinated bursts at unusual hours.
Per SOCRadar, refusals held within individual sessions but not across them: refused tasks were re-framed with a copy-pasted "authorized pentest on my own infrastructure" script in a fresh session. Cross-session refusal correlation is the control that defeats this.
The SOCRadar name for a single-operator Initial Access Broker active since July 2026, who ran up to 51 coordinated Claude Code agents plus PentAGI wired to Cobalt Strike, and held data of more than 628,000 individuals.
Centralize every agent session's prompts, tool calls, and outputs; alert on burst-rate anomalies across agents; compare target lists between concurrent sessions; correlate model refusals across sessions; and look for identical phrasing in prompts across sessions.
According to SOCRadar, model safety refusals held within individual sessions but not across them. When a task was refused, the operator re-framed it with a copy-pasted 'authorized pentest on my own infrastructure' script in a fresh session. Cross-session refusal correlation is the control this defeats.