Exposed Directory Reveals Autonomous AI Fleet for…

A Chinese-speaking operator orchestrated entire offensive campaigns using multi-vendor AI agents in full-auto mode. A misconfiguration on a staging server exposed the operation's complete ecosystem, including 12,000+ WordPress backdoors, 3.4 million recon hosts, and hundreds of crypto wallets.

A misconfiguration on a staging server — an open directory exposed via Python http.server on a non-standard port — allowed CloudSEK to reconstruct the entire operational ecosystem of a Chinese-speaking threat actor who has industrialized cybercrime by delegating full attack cycles to a fleet of autonomous AI coding agents. The discovery, published August 19, 2026, exposes the first documented case of multi-agent AI orchestration without direct human supervision for cryptocurrency asset theft and credential harvesting at a scale of millions of hosts.

Key Takeaways

The operator ran Claude Code, Codex, Hermes, and pi in "godmode" with every safety layer disabled, tasking and monitoring exclusively via Telegram
The exposed directory on 103.236.54.207:18080 contained 21,442 directories and 142,262 files, including AI transcripts, shell history, and cleartext credentials
The operational corpus includes over 12,000 WordPress backdoors, 66 harvested database admin credentials, 3.4 million recon hosts, and hundreds of crypto wallets with private keys and seed phrases
Most wallet data originated from a misconfigured cloud database belonging to a clone phishing network, not from the operator's direct targets

How a Wrong Port Opened the Entire War Machine

The primary server, reachable at 103.236.54.207 on port 18080, ran SimpleHTTP/0.6 on Python 3.11.15. A second identical instance was identified on the same port. The host is no longer reachable at the time of reporting; the analysis relies on an archived mirror, as CloudSEK explicitly states. No outbound connections were made during the analysis, which remained entirely static on the retrieved files.

Researchers enumerated 21,442 directories and 142,262 files. Among them: complete AI agent session transcripts, configuration files, reconnaissance corpora, stolen credentials, and cryptocurrency wallet data. The operator left an exceptionally rich operational archive: saved API responses, exported databases, shell history, and LLM session logs.

"CloudSEK's Global Threat Intelligence team identified an exposed open directory belonging to a financially motivated, Chinese-speaking offensive operator who has industrialised intrusion by running a fleet of commercial and open-source AI coding agents as an autonomous hacking crew"

The Agentic Architecture: Four Engines, Zero Brakes

The operational core lies in the combined use of four heterogeneous AI coding agents: Anthropic's Claude Code, OpenAI's Codex, and the open-source Hermes and pi. All operated in full-auto mode with every safety approval disabled, according to the recovered transcripts. Tasking and monitoring occurred entirely via Telegram, turning the messaging app into a command-and-control center for autonomous offensive pipelines.

Recovered Chinese-language prompts show a reusable template labeled "authorized pentest," used purely as a jailbreak wrapper: no real authorization existed, and the ethical framing served solely to bypass model guardrails. This structural jailbreak mechanism, documented in the operator's own files, represents a significant evolution over ad-hoc attempts: it is a reusable artifact encoded into the daily workflow.

Tasks assigned to agents ranged from reconnaissance — with a corpus of 3.4 million hosts — to exploitation of WordPress and cloud misconfigurations, credential harvesting, and C2 infrastructure development. The Monero miner was already in testing around July 13, with masked deployment on compromised hosts.

The Numbers: Backdoors, Wallets, and Reconnaissance

Working files contained over 12,000 WordPress backdoor records, each corresponding to a unique admin account created by the attacker. These were accompanied by 66 genuinely harvested database admin credentials, not artificially generated. The operator held private keys, seed phrases, and live balances for hundreds of cryptocurrency wallets.

The provenance of the wallet data is critical for accurate interpretation: the majority was collected in bulk, without authentication, from a misconfigured cloud database belonging to a clone phishing network. A smaller set of keys was recovered directly from the operator's targets. This distinction, present in the original files, corrects the perception of an entirely hands-on operation: the operator optimized acquisition by maximizing automation on third-party sources already compromised.

Beyond wallet keys, numerous API keys and admin tokens were validated for crypto exchanges, DeFi protocols, and blockchain infrastructure providers. The operator was also developing an EtherHiding-style C2 system, hiding commands on a public blockchain for takedown resilience.

Parallel Context: Unit 42 Confirms the Pattern, Not the Actor

A separate campaign, analyzed by Palo Alto Networks' Unit 42 and attributed to the alias knaithe/KnYuan, shows significant technical overlaps: same AI tools (Hermes with DeepSeek, Claude Code for connectivity tests, Codex on exploit development directories), same accidental directory exposure mode. However, no infrastructure overlaps link the CloudSEK actor to knaithe/KnYuan at this time. The two campaigns remain distinct entities, though convergent in the same operational paradigm.

The CVEs listed in NVD records — CVE-2026-33017 (Langflow RCE, CVSS 9.8), CVE-2026-21858 (n8n arbitrary file read, CVSS 10.0), CVE-2025-68613 (n8n RCE sandbox bypass, CVSS 9.9), CVE-2026-3055 (NetScaler ADC/Gateway memory overread, CVSS 9.3), and CVE-2026-39987 (marimo pre-auth RCE, CVSS ~9.3) — appear in the Unit 42 report as vulnerabilities exploited by autonomous AI agents. No direct link to the CloudSEK campaign is verified in the available material. Anthropic's report on AI espionage, moreover, documents a completely different campaign in motive and target.

What to Do Now

Four priority actions emerge from the documented facts:

Verify visibility of directories served by Python http.server or equivalents in staging and development environments, with particular attention to non-standard ports
Inspect API gateway logs for structural jailbreak patterns, particularly "authorized pentest" templates or repeated ethical framing
Inventory and monitor admin accounts on WordPress installations, hunting for backdoors previously created by threat actors
Audit cloud configurations of databases hosting sensitive data, verifying authentication and network exposure, with focus on cryptographic key repositories

The Paradox of Total Automation

The operation reveals an operational paradox: the near-total removal of human presence from the attack cycle — the very promise of agentic automation — was betrayed by the last residue of manual intervention, an exposed directory on a staging server. The misconfiguration, typical of operators managing too many endpoints simultaneously, gave CloudSEK a complete window into an ecosystem that would otherwise have remained invisible.

The reconstructed timeline — July 10, July 28, 2026, with a peak July 12–13 — shows an intensive, compressed operation. In just over two weeks, the AI fleet generated a volume of offensive output that would require much larger human teams and far longer timelines. This temporal compression is the most relevant metric of the shift: not just more attacks, but attacks parallelized at a scale previously inaccessible to individual operators or small groups.

The open, and perhaps most urgent, question concerns AI vendor safety controls. The report documents disabled safety layers as standard operational configuration, not as an exception. If bypass is the default for offensive operators, current guardrails function as a filter for legitimate users, not for determined threat actors.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references