This week, threat-intelligence firm SOCRadar documented CyberXero — a single-operator Initial Access Broker who ran up to 51 coordinated Claude Code agents in recon, exploitation, and exfiltration roles, plus the open-source PentAGI agent framework wired to Cobalt Strike command-and-control. Active since July 2026, the campaign reconnoitered Ukrainian energy and utilities firms in a manual campaign, affected 40+ organizations worldwide, and put the data of more than 628,000 individuals in the operator's hands. The scariest part: the evasion worked because per-session safety held, but cross-session safety didn't. Take this 8-question check — it tests the exact controls that would have made this attack impossible, or at least visible. Free, no signup.
Answer for the agent fleet YOU operate. Here, "Yes" is the safe answer.
Informational self-assessment based on the publicly reported SOCRadar CyberXero findings (October 2026). Not legal or compliance advice. Figures cited: up to 51 agents, 4,708 targets scanned, 429 WordPress admin panels, 32 webshells in 61 seconds, 40+ organizations, 628,000+ individuals, 90,000+ exposed files — all per the SOCRadar report.
CyberXero showed what one operator with 51 coordinated agents can do — recon, exploitation, and exfiltration at machine speed. Your fleet has the same architecture: the only difference is intent and targeting. This check scores your swarm risk across eight dimensions, from agent count to tool permissions to network egress. A high score does not mean you are malicious — it means one compromised credential could weaponize you.
CyberXero is the name given by SOCRadar to a single-operator Initial Access Broker active since July 2026, who coordinated up to 51 Claude Code agents plus the PentAGI framework wired to Cobalt Strike C2. 40+ organizations were affected and data of more than 628,000 individuals was collected.
Per the SOCRadar report, safety refusals held within individual sessions but not across them: the operator re-framed every refused task with a copy-pasted "authorized pentest on my own infrastructure" script in a fresh session. Defenses must correlate refusals across sessions, not just within them.
Cap concurrent agent sessions, enforce least-privilege tool permissions per agent, require human approval for high-impact actions, keep tamper-resistant session logs, track model refusals across sessions, store agent artifacts on private authenticated storage only, and maintain a fleet-wide kill switch with monitored network egress.
The main risks are prompt injection, tool abuse (agents using broad permissions in unintended ways), credential and data exfiltration, unauthorized real-world actions at swarm scale, exposed session artifacts, and oversight that doesn't survive across sessions.
The operator left more than 90,000 files — AI session logs, attack scripts, and victim data — on an internet-exposed directory. That exposure is how SOCRadar's researchers found and documented the campaign. It is the same class of operational error this check tests: exposed agent artifacts.
Yes — that is the point of the SOCRadar report. A single operator coordinated up to 51 Claude Code agents with specialized roles. In one automated run, the swarm scanned 4,708 targets, confirmed 429 accessible WordPress admin panels, and deployed 32 webshells in 61 seconds. Agent orchestration has collapsed the cost of running a coordinated intrusion team.
According to SOCRadar, model safety refusals held within individual sessions but not across them. When a task was refused, the operator re-framed it with a copy-pasted 'authorized pentest on my own infrastructure' script in a fresh session. Per-session refusal without cross-session tracking is a gap, not a control — question 5 of this check tests exactly that.