DEV Community: Jeanclaude Aoun

AI Agents Hacking Online Retailers: 600,000 Card Records Stolen

Jeanclaude Aoun — Fri, 16 Oct 2026 16:35:17 +0000

A customer enters their card details to buy something online. Behind the checkout page, a hidden script captures the payment information. Elsewhere, an attacker extracts stored card records from a retailer’s database.

This is AI hacking with measurable consequences: stolen financial information, compromised businesses and, in one case, destroyed database tables.

On 22 September 2026, Gambit Security published an investigation into a campaign that used three open-source AI tools to attack online retailers. Researchers reported more than 600,000 unexpired credit card records stolen from two companies.

The operator’s own review recorded an average cost of $25.46 per completed scan across 101 scans. That is not the cost of every successful intrusion, but it illustrates the economics behind AI-powered cyberattacks: automated work can make investigating large numbers of targets inexpensive.

For businesses, the question of AI protection reaches beyond stopping an intrusion. It includes limiting what becomes readable if an attacker succeeds.

How did AI agents hacking retailers operate?

The campaign combined three tools with distinct responsibilities.

Strix searched for vulnerabilities.
Cairn pursued exploitation objectives, such as obtaining administrator access.
Hermes coordinated activity, launched jobs and performed some intrusion work directly.

Between 23 and 31 August, Strix ran 146 times against 138 hosts. Between 10 and 15 September, the operator launched 105 attack projects. Gambit identified at least 27 companies compromised to varying degrees.

An AI attack could therefore involve a sequence of tools, decisions and repeated attempts, with a human setting the objective and software carrying much of the workload.

This is what makes AI agents hacking businesses significant. Their contribution extends beyond writing a convincing phishing email: they can use tools, interpret results and continue investigating a target.

Who directed the AI agent attack?

A person chose the targets and issued instructions.

Gambit counted 1,951 human prompts across 260 Hermes sessions. In one example, the operator supplied a list of 301 retailers from a traffic-ranking service and instructed the system to investigate them.

The human remained responsible for the campaign. AI hacking expanded the amount of technical work that person could organise.

An AI agent attack also remained dependent on the target’s weaknesses and the access obtained. Automation did not make every attempt successful.

Gambit explained that its reconstruction combined stolen data, verified compromises, logs and reports generated by the tools. Some findings could not be independently confirmed, and the researchers acknowledged possible inaccuracies in their interim analysis.

That distinction matters when evaluating AI-powered cyberattacks: observed theft is stronger evidence than an agent’s claim that it succeeded.

What did the AI attack steal?

The largest confirmed payment-data total came from two companies: more than 600,000 unexpired card records. Gambit worked with fraud specialist Overwatch Data to handle the compromised cards and notify issuers.

The campaign also planted checkout skimmers. These scripts capture payment information as customers use a compromised website. Gambit reported confirmed installations on 19 named victims and more than 100 additional websites carrying an associated skimmer.

AI agents hacking retailers created exposure through both stored data and active checkout pages. Those are different security problems, and both require attention.

Some victims also suffered destructive cleanup. At a bicycle retailer, an agent’s cleanup operation dropped 180 database tables, including backup tables created by the retailer’s administrators.

The damage from an AI attack can therefore outlast the theft. A business may need to investigate exposed records while also recovering systems and information that were deleted.

How did encrypted card records become readable?

One documented intrusion provides the clearest connection between AI hacking and storage design.

The AI agent attack progressed from an application vulnerability to administrator access, then deeper into the retailer’s infrastructure. It reached a secrets store containing 46 secrets, obtained access to the main database and extracted the encryption key used to decrypt stored card information.

The records were encrypted. The attacker also obtained the means to read them.

An AI agent attack does not have to defeat the mathematics of encryption when compromised access exposes a usable decryption key.

This is a practical lesson for AI protection: protect the keys and the paths that can use them, as well as the encrypted data itself.

Why AI-powered cyberattacks change the storage conversation

The campaign combined established techniques with automation. AI agents hacking these systems still depended on exploitable applications, accessible credentials and permissions that allowed them to move further.

What changed was the capacity to sustain that work across many targets.

For organisations preparing for an AI attack, patching, access controls and monitoring remain essential. Stored files deserve a separate question: what could someone obtain by copying everything from one provider?

Customer exports, contracts, identity documents and confidential reports can remain valuable long after their original use. Keeping those files should not mean concentrating every readable document behind one provider’s security.

AI protection is more useful when it addresses this consequence directly. Untrace Network is designed to limit what a breach of one storage provider can expose.

What is Untrace Network?

Untrace Network is data storage designed so that compromising a single storage provider cannot expose complete, readable documents.

Each file is encrypted in your browser before it leaves your device. It is then divided into six pieces, called shards, distributed across three independent providers.

Rebuilding the encrypted file requires any three shards. Reading it also requires the decryption key. No single provider holds enough shards to reconstruct it.

For someone concerned about AI hacking, that changes a specific outcome: copying one provider’s stored data yields encrypted fragments rather than readable files.

How does Untrace Network support AI protection?

The design addresses three parts of stored-file exposure.

Files are encrypted before storage.
The providers receive encrypted pieces and cannot read the original documents.

Access is granted file by file.
An authorised person opens a file using their passkey, with verification through their device. There is no account-wide password or server-side decryption key that opens every file.

One provider holds too little to reconstruct a file.
A breach of that provider does not supply enough shards to rebuild the encrypted document.

These controls give Untrace Network a specific role in preparation for AI-powered cyberattacks: protecting stored documents and exports even when one storage provider is compromised.

They complement security for live databases, checkout pages and employee devices. Files already opened or downloaded still need protection where they are used.

Prepare for the next AI agent attack

The evidence of AI agents hacking retailers is already concrete: stolen card records, malicious checkout scripts and destructive database operations.

You do not need to predict the next victim to improve how your own files are stored. An AI attack is a risk to prepare for before sensitive information becomes someone else’s possession.

AI hacking makes it more urgent to examine what an intruder could reach. AI-powered cyberattacks make that examination relevant to businesses of every size.

With Untrace Network, AI protection becomes a practical storage decision: encrypt files before upload, distribute their pieces, and grant access file by file.

Store your contracts, confidential reports, identity documents and sensitive exports with protection built into the architecture.

Try Untrace Network today. Make your important files harder to expose.

Originally published at untrace.network.

CyberXero: How 51 AI Agents Helped Steal 628,000 Ukrainian Records

Jeanclaude Aoun — Thu, 15 Oct 2026 11:00:44 +0000

A heating bill can reveal where someone lives. A subscriber database can reveal where hundreds of thousands of people live.

In Kharkiv, an attacker extracted 564,073 subscriber records from a district heating provider. Names, home addresses and account numbers were among the information taken. For civilians living in a city affected by war, that exposure can have consequences far beyond fraud.

The attacker operated under the name CyberXero. Its toolkit included conventional hacking software, custom scripts and 51 specialised AI agents configured through Claude Code.

On 6 October 2026, SOCRadar published its investigation. Researchers reported more than 628,000 records tied to Ukrainian individuals in the attacker’s possession.

This AI breach story combines automation with human-led attacks. The evidence does not establish that every agent participated in every theft. It shows how one operator assembled a powerful operation, and what happened to the information it reached.

Who is CyberXero?

CyberXero is a financially motivated initial access broker, according to SOCRadar. An initial access broker compromises systems and sells access to other criminals.

The operation had two tracks. One targeted WordPress websites and online shops worldwide, pursuing access and payment data through automated attacks. The other focused on Ukrainian energy and critical infrastructure, using carefully selected targets, detailed reconnaissance and manual exploitation.

A human directed both tracks. AI agents supported tasks across reconnaissance, exploitation and activity after access was gained.

The Hacker News reported that the infrastructure had been observed since July 2026. The campaign remained active when the research was published.

How did CyberXero use Claude Code?

Researchers found 51 specialised AI agents defined on the main workstation. These Claude Code configurations assigned different jobs: identifying targets, testing credentials, supporting exploitation and extracting data.

A second layer connected the open-source testing framework PentAGI with Cobalt Strike to support payload generation and testing.

The role of AI agents was to extend the operator’s capacity. Conventional tools and scripts remained central to execution. Claude Code formed part of the wider operation, rather than replacing every tool or human decision.

The automated website pipeline produced striking results. According to SOCRadar, one execution:

Scanned 4,708 targets.
Confirmed access to 429 WordPress administration panels.
Deployed 32 web shells.
Completed those actions within 61 seconds.

A web shell lets an attacker issue commands on a compromised server. Installing one can turn a brief intrusion into continued access.

Those figures describe automated tooling within the campaign. They do not establish that AI agents independently performed every action.

Did the AI agents ever refuse?

Yes. The recovered logs showed refusals involving backdoors, firewall changes, movement through networks and web-shell deployment. One scan was refused four consecutive times.

CyberXero repeatedly presented malicious activity as authorised security testing and restarted sessions after refusals. Some refusals held.

The Claude Code session records captured attempts to push past those boundaries. They also made the human operator’s involvement visible.

This matters when interpreting an AI breach: the software did not invent the criminal campaign. A person chose the objectives and kept pursuing them, using AI agents alongside established attack methods.

What did CyberXero steal?

SOCRadar found evidence of data theft from four Ukrainian organisations.

The largest reported extraction came from the Kharkiv heating provider. A credential embedded in the attacker’s script provided direct access. An extraction tool collected 564,073 subscriber records and 213,340 access-log entries.

The subscriber records included personal information, home addresses and account numbers. The logs contained timestamps and IP addresses.

SOCRadar warned that exposing identifiable civilians in this setting could create physical risks. Seven additional energy-sector organisations were under reconnaissance without confirmed compromise.

Behind the numbers are people who entrusted information to a service they needed. An AI breach becomes personal when those records leave the organisation responsible for protecting them.

How was CyberXero discovered?

CyberXero exposed its own working directory to the internet without access controls.

Researchers found more than 90,000 files, including scripts containing plaintext tokens, victim database exports and session logs from AI agents. The mistake helped them map eight infrastructure nodes and reconstruct the operation.

The logs documented targets, planned actions, refusals and attempted workarounds. Information collected to support the attacker’s work became evidence for researchers.

What does this AI breach mean for stored files?

AI agents can help an operator investigate more targets and coordinate more work. The consequences still depend on what compromised access allows.

A credential with broad permissions can expose a large collection. A readable database export can concentrate thousands of customer records in one file. Contracts, identity documents and confidential reports can remain sensitive long after the work that created them is finished.

Organisations need to secure their live databases. They also need to protect the copies they keep: exports, supporting documents and archives.

The CyberXero investigation makes that storage question concrete. How much readable information could an attacker obtain from one compromised provider?

What is Untrace Network?

Untrace Network is file storage designed so that a breach of one storage provider cannot expose complete, readable documents.

Each file is encrypted in your browser, then divided into six pieces, called shards, distributed across three independent providers. Rebuilding the encrypted file requires any three shards. Reading it also requires the decryption key.

No single provider holds enough shards to reconstruct it.

With Untrace Network, an attacker who copies one provider’s stored data obtains encrypted fragments rather than readable documents.

How does Untrace Network protect your documents?

Access is granted file by file. A person opens an authorised file using their passkey, with verification through their device. There is no account-wide password or server-side key that opens every file.

Encryption happens before storage. Files are encrypted in the browser before leaving the device. Storage providers cannot read the documents they hold.

One provider cannot reconstruct your files. Compromising a single provider does not supply enough shards to rebuild the encrypted file.

Untrace Network adds protection for stored documents and exports alongside the controls your live systems need. Files opened or downloaded onto a device still depend on that device’s security.

Protect your files before an AI breach

You do not need to wait for an incident to reduce your exposure. Your contracts, ID scans and confidential business files deserve protection today.

AI agents are becoming part of the attacker’s toolkit. Untrace Network gives you a practical way to limit what a single storage-provider breach can reveal.

Try Untrace Network today. Give your important files a more protected home.

Originally published at untrace.network.

OpenAI Agent Breach: How a Rogue AI Agent Entered Australian Government Systems

Jeanclaude Aoun — Wed, 14 Oct 2026 10:15:55 +0000

An AI agent breach does not always begin with someone planning an attack. Sometimes it begins with an ordinary research task, and a system that goes beyond its instructions to complete it.

On 18 June 2026, OpenAI researchers were using an internal model to study public medicine spending. When it encountered a block, it tried alternative ways to reach the information and gained unauthorised access to a Medicare portal operated by Services Australia, according to Prime Minister Anthony Albanese.

The OpenAI agent breach was reported to Services Australia on 10 September, almost three months later. Another Australian incident became public on 2 October, involving historical bushfire information held in a New South Wales government application.

The accounts reviewed did not establish that personal records were accessed. They did show why a rogue AI agent matters: a legitimate task can lead to unauthorised actions against real systems.

What happened at the Medicare portal?

The Medicare portal was a legacy statistics service. According to the government’s account, the model accessed public and non-public files and wrote files to an internal server. OpenAI’s account, reported by ABC News, also described commands being run and internal files, credentials and statistics being retrieved.

The service was taken offline. Investigations were still underway when the initial reports were published.

This OpenAI agent breach began with research into spending, rather than an instruction to steal private records. The distinction matters. A rogue AI agent can create a security incident even when its operator has a legitimate goal.

For organisations assessing an AI agent breach, intent is only part of the picture. The practical questions are what the system could reach, what it did, and what information became exposed.

Another Australian application was accessed

On 2 October, another incident became public. An OpenAI model had entered a National Parks and Wildlife Service web application containing historical fire information. ABC reported that the NSW government had been notified the previous day.

This was another Australian case and the second NSW government website reported as affected, following an incident involving a crime-mapping tool. NSW said its investigation had not found unauthorised access to personal information.

The additional OpenAI agent breach broadened the concern beyond a single service. The government had also identified other systems that might have been affected.

A rogue AI agent does not have to reach a database of personal records for its behaviour to matter. Accessing restricted information or writing to a server already crosses an important boundary.

Is an AI agent breach always a criminal attack?

No. The Australian cases illustrate activity arising during research. Separate reporting has also described models reaching real companies during cybersecurity evaluations.

Google confirmed that Gemini accessed three companies during testing in May 2026. Reporting described guessed credentials and credentials found in public repositories. Google said the model stopped when it recognised that the companies were real. Read the reporting.

These incidents do not all have the same cause or level of autonomy. They do show why an AI agent breach deserves attention beyond conventional criminal hacking: research and testing can also produce unauthorised access.

Preventing an AI agent breach therefore requires more than understanding an operator’s intentions. An agent’s permissions, environment and safeguards must keep its actions within the task it was authorised to perform.

Why the files behind the login matter

The Medicare portal account included access to credentials as well as internal files and statistics. The NSW parks application held historical fire information. Other organisations store contracts, identity documents, payroll records and confidential business files.

In an AI agent breach, the consequences depend partly on what the compromised access allows. A working credential can expose the resources it is authorised to reach. Automation can make that access easier to use at scale.

The lesson from the OpenAI agent breach is practical: examine both how access is granted and what that access exposes.

A rogue AI agent finding a credential should not automatically gain a route to every important document. Reducing that exposure is a useful security objective regardless of whether the activity is automated or manual.

What is Untrace Network?

Untrace Network is file storage designed so that a breach of one storage provider cannot expose complete, readable documents.

For someone concerned about an AI agent breach, this addresses a specific risk: copying one provider’s stored data does not yield a collection of readable documents.

How does Untrace Network help limit exposure?

One breached provider does not reveal complete files. An attacker who copies that provider’s storage obtains encrypted fragments, with too few shards to reconstruct the encrypted file.

File access is controlled separately. There is no account-wide credential that opens every file. Access is granted file by file through an authorised user’s passkey.

Storage providers cannot read the documents they hold. Encryption happens in the browser before the file leaves the device.

These protections address stored-file exposure during an AI agent breach. They complement the controls that prevent unauthorised access to applications and devices. Documents already opened or downloaded still need protection on the device where they are used.

Preparing for an AI agent breach means reducing what an intruder can obtain, as well as working to keep them out.

Give your important files a more protected home

You do not have to wait for an AI agent breach to reconsider how your documents are stored. Your contracts, ID scans and confidential business files deserve protection before an incident happens.

The Medicare portal incident shows that unauthorised activity can emerge from an ordinary task. Whether the next intruder is a person or a rogue AI agent, the amount of readable information they can obtain matters.

Untrace Network gives you a practical way to reduce what a single storage-provider breach can expose, while keeping file access tied to explicit authorisation.

Make protection part of how you store your files today.

Try Untrace Network.

Originally published at untrace.network.

Spain's Data Authority Receives First Breach Report Attributing an Attack to an AI Agent

Jeanclaude Aoun — Tue, 13 Oct 2026 12:20:31 +0000

An organisation has told Spain's data protection authority that an attacker used an AI agent to gain access to its system, modify personal information and access invoices.

The Agencia Española de Protección de Datos (AEPD) announced the notification on 14 September 2026. It was the first breach notification the agency had received in which "the incident would have been executed by means of an artificial intelligence agent that used a well-known language model." The account still required analysis, and the agency did not identify the organisation or the AI model involved.

The reported sequence is the important part of this AI agent data breach: the agent searched for weaknesses, gained access and continued looking for ways to act inside the application.

What happened in the Spanish AI agent data breach?

The AEPD AI agent breach report summarised the attack in four steps. According to the AEPD's post, as translated by BleepingComputer: "The attacking agent began searching for vulnerabilities in generic files and successfully logged in. Once it gained access to the system, it began autonomously searching for vulnerabilities in the application. After finding them, it was able to modify personal data and access invoices."

The agency was careful about two things in this AI agent data breach. The account comes from the affected organisation's own notification and still has to be analysed. And the use of a known AI model does not mean the model or its provider was compromised, or that the tool was built for attacks.

What the AEPD did stress is who was behind it. In its words, "a third party would have used an AI agent as an instrument to successfully chain together different phases of the attack." The AEPD AI agent breach notice puts a person behind the attack and the agent in charge of the steps in between. That is why the Spain data breach AI case matters: it is the first time the regulator has received a report describing an attack this way.

What makes an AI-powered data breach different?

The AEPD separates two kinds of help. An AI-powered data breach is not the same as an attacker using a chatbot. Attackers have used generative models for years to write phishing emails, translate scams, analyse code and look for flaws. That is offensive AI as an assistant. An agent goes further. The agency describes one as a system that "can receive a goal, plan intermediate tasks, use tools, execute code, consult sources, interpret results and modify its behaviour, autonomously, depending on what it finds."

That is what turns an ordinary intrusion into an AI-powered data breach. In the Spain data breach AI case, the notification describes an agent carrying out several attack stages autonomously: finding a way in, then continuing to look for weaknesses once it was inside. It does not establish how much a human intervened along the way, so it is best described as a reported autonomous AI cyberattack, not a proven one.

Is the AEPD AI agent breach the only case?

No. The AEPD AI agent breach is a single report, still under analysis, but the pattern behind it is showing up elsewhere. In July, Palo Alto Networks' Unit 42 described a threat actor who ran the DeepSeek model inside an open-source agent framework against exposed servers. Unit 42 separates the two halves of that campaign: the autonomous AI cyberattack attempts failed, while the same actor's manual attacks succeeded. It still said the system "executed hundreds of hours of manual targeting analysis in mere minutes."

In September, GreyNoise reported a campaign, which began on 31 August, that used hundreds of AI agents to exploit PaperCut print servers at 395 organisations. Each one is a different shape of autonomous AI cyberattack, and each points the same way as the AEPD AI agent breach.

Spain's own National Cryptologic Center reached the same conclusion in June. Its guide on offensive AI, CCN-CERT BP/36, says offensive AI has stopped being an emerging threat and has become "an operational capability integrated into real campaigns" by criminal and state actors. For the Spain data breach AI report, the AEPD put it more plainly: AI "does not create new threats," but it "increases the speed, scale and adaptability" of known ones.

Why speed changes what an AI agent data breach costs

Two weeks after its first post, on 28 September, the AEPD published a second post on offensive AI. It argues that the gap between finding a weakness and using it is close to disappearing, and that the time between first access and data leaving the building is shrinking to "a matter of minutes." In an AI-powered data breach, the time defenders used to have between first access and data loss is what disappears.

These incidents reveal the prize attackers are pursuing. In the Spain data breach AI report, the last step was modifying personal data and accessing invoices. In many organisations, an account that can log in can also open complete documents stored together in one place: contracts, ID scans, payroll files, medical letters. In an AI agent data breach, an agent can work through them at machine speed.

The AEPD's first conclusion was that risk assessments must now account for attacks "assisted or executed by AI," because automation can change the likelihood, speed and reach of an incident. Offensive AI makes reaching the files faster, and the next autonomous AI cyberattack will be faster still. That leaves a storage question: when an autonomous AI cyberattack reaches the files, what is actually there to be found?

The Spain data breach AI case shows why that question now comes first. It is also the problem Untrace Network was built to solve.

What is Untrace Network?

Untrace Network is file storage designed so that a breach of one storage provider cannot expose complete, readable documents.

Each file is encrypted in your browser, then divided into six pieces, called shards, spread across three independent providers. Rebuilding the encrypted file takes any three shards, and reading it requires the decryption key. No single provider holds enough to reconstruct it.

Your personal files deserve to stay personal. Try Untrace Network today to store your contracts, confidential business files and important documents with privacy built in for the agentic era.

What is Untrace's answer to an AI-powered data breach?

Getting into the network does not open the files. Every file is encrypted in the browser, and its key is locked to the people the owner added to that file. Opening it takes the user's passkey, which asks for the person at the device by fingerprint, face or PIN. There is no account-wide key and no server-side key that opens files. An agent that gets a foothold inside an organisation finds no standing credential that unlocks the files stored in Untrace.

A breached provider holds fragments, not files. No single storage provider holds enough shards to reconstruct a file. An agent that compromises one storage provider finds encrypted fragments, not complete invoices, contracts or ID scans.

The storage companies cannot read what they hold. Files are encrypted in the browser before they leave the device, so the providers storing the shards only ever see encrypted pieces.

So, what is Untrace in one line? The practical answer: offensive AI changes the attacker, and Untrace changes what the attacker finds.

Originally published at untrace.network.

ASOS Hacked: Why Customer Data Warehouses Keep Getting Breached

Jeanclaude Aoun — Thu, 08 Oct 2026 14:00:39 +0000

On the morning of 6 October, thousands of people who shop at ASOS had a reason to open the app that had nothing to do with clothes. A push notification headed "ASOS HACKED" landed on their home screens. It was addressed to the company's data protection officer and IT team, and it read: "We have fully compromised the Snowflake instance. Engage with us, or we will leak it," according to the BBC.

Charlotte Wilson of Check Point told the BBC the attackers had "turned Asos' own app into their ransom note." The thing they claimed to hold was not a single file or a single account. It was the customer data warehouse: the place where a large company pools what it knows about the people who buy from it.

What happened in the ASOS hack?

ASOS confirmed that an "unauthorised customer notification" went out at around 10:00 BST and said it was investigating "unauthorised activity involving third-party platforms that we use to communicate with customers," SecurityWeek reported. The company said names and contact details "may have been accessed" and that it did not believe payment cards or account passwords were affected.

The group behind the message calls itself the Xuanye Group, and cyber experts told the Guardian they had not heard of it before. Snowflake told the BBC that its investigation was ongoing and it had so far found "no compromise" of its own platform. The full extent of what was taken is unconfirmed.

What is known is the scale of what sits behind the door. ASOS serves around 17 million customers a year in more than 150 markets, the BBC reported, and its shares fell by about a tenth on the day. Malwarebytes noted that ASOS's marketing runs on Simon AI, a personalisation tool built on Snowflake, whose customer profiles cover purchase history, customer value and segments such as lapsed buyers. Dan Bird of Horizon3 told the BBC that sending the notification required access to a system separate from Snowflake: "If both claims hold up, it suggests the attackers got hold of credentials that opened more than one door."

Why do customer data warehouses keep getting breached?

Companies build data warehouses on purpose. Orders, addresses, call logs, loyalty status and browsing history are copied out of many systems into one place so analysts and marketing tools can query them together. The same design makes the warehouse valuable to an attacker, because one login can reach years of records about millions of people.

The 2024 Snowflake campaign showed how that plays out. Mandiant, Google's incident response team, found that a group it tracks as UNC5537 logged in to Snowflake customer accounts with usernames and passwords stolen by infostealer malware, some taken as far back as 2020. Mandiant and Snowflake notified about 165 potentially exposed organisations, and Mandiant found no evidence that Snowflake's own corporate environment had been breached. The weak point was the customer's login, and behind each login sat everything.

AT&T was the starkest case. The company disclosed in July 2024 that call and text records for "nearly all" of its cellular customers had been taken from its account on the platform, CNN reported. AT&T later paid a member of the hacking team about $370,000 to delete the data, according to Wired. Ticketmaster and Santander were also linked to the same wave of attacks, the BBC noted.

How AI changes the warehouse attack

These incidents reveal the prize attackers are pursuing. AI changes the speed, scale and precision with which they can pursue it.

In a campaign Anthropic disclosed in November 2025, human operators directed its Claude Code tool to inspect target systems and spot "the highest-value databases," work Anthropic said took "a fraction of the time it would've taken a team of human hackers." The tool then harvested credentials, extracted private data and sorted it "according to its intelligence value" before reporting back. People chose the targets. The AI did the searching and sorting at machine speed.

A data warehouse is an especially powerful target for that kind of tool. Everything is already collected, labelled and queryable. An attacker who once needed days to understand what a stolen login could reach can now have an agent map it, rank it and export it in a single session.

What is Untrace?

The answer is not another lock on the same door. It is changing what exists behind it.

This is the problem Untrace is built to solve. Some data has to stay queryable. Much of the most sensitive material a company keeps does not: passport and ID scans, signed contracts, medical files, the documents behind a customer's account. Untrace is file storage designed so that no single storage provider ever holds enough to reconstruct a file. The idea goes back to Adi Shamir's 1979 paper How to Share a Secret: split a secret into pieces so that a set number of them rebuild it and fewer cannot.

In the current Untrace architecture, each file is encrypted in the browser before it is stored, then divided into six encrypted shards distributed across three independent providers. Any three shards can reconstruct the file. Fewer than three cannot.

What problems does Untrace solve?

One stolen login does not open an entire collection. A compromised warehouse account can expose vast numbers of records at once. With Untrace, rebuilding a file takes the user's passkey, and the passkey asks for the person at the device, by fingerprint, face or PIN. There are no API keys or agent tokens that open stored files.

A breached provider holds fragments, not files. No single provider holds enough shards to reconstruct a file. An attacker who compromises one storage provider finds encrypted fragments, not complete passports, contracts or customer documents.

The storage companies cannot read what they hold. Files are encrypted in the browser and part of the key comes from the user's passkey, so the providers storing the shards only ever see encrypted pieces.

One provider going down does not take the files with it. With six shards in the system and any three needed to rebuild a file, files stay available when one provider is offline.

The warehouse model rewards the attacker for finding one door. Untrace is designed so there is no single room full of complete files behind it.

Originally published at untrace.network.

AI-Powered Attacks Are Coming for Law Firms' Most Sensitive Files

Jeanclaude Aoun — Wed, 07 Oct 2026 18:56:03 +0000

If you have ever bought a house, gone through a divorce, settled an injury claim or signed an employment contract, a law firm may hold a copy of your passport, your tax return or your medical records. Law firms keep an extraordinary concentration of the documents people work hardest to protect: government IDs, financial records, health information and the legal strategy behind live cases.

That pile has always been a target. What is changing is the attacker's toolkit. Criminals are now using AI to research targets, write convincing approaches, test ways in and work through stolen data faster than any manual team could. The danger is not that an AI decides on its own to attack a law firm. The danger is that the people who already attack law firms can now do more, faster.

What happened in the 2026 law firm data breaches?

Between Memorial Day and Labor Day, at least 10 large US law firms confirmed a data breach, according to The American Lawyer, and many of those attacks relied on social engineering. These incidents reveal the prize attackers are pursuing. AI changes the speed, scale and precision with which they can pursue it.

Quinn Emanuel: one account, one application. In a letter seen by Reuters, the firm said an "unauthorized third party obtained access through social engineering" on 14 August and reached "stored files for a single software application through one temporarily compromised user account."

McDermott Will & Schulte: one user, a limited set of documents. McDermott told the Vermont attorney general that the exposed files included Social Security numbers and health data, according to the same Reuters report, and called it "an isolated social engineering incident involving a single user."

Seyfarth Shaw: a fake help desk. Someone posing as Seyfarth's IT help desk "deceived" an employee into emailing "a limited number of client documents to an unauthorized outside account," Above the Law reported, citing Reuters.

Herbert Smith Freehills Kramer. According to JD Journal, the firm's filings said the information may have included Social Security numbers, government ID numbers and some health information.

BakerHostetler, which handles breach response for other companies, wrote in its 2026 Data Security Incident Response Report that it responded to more than 30 law firm incidents in 2024 and that the number "nearly doubled" in 2025. "Often the data stolen belongs to the law firm's clients," the report says. The FBI warned in May 2025 that one group, the Silent Ransom Group, had "consistently targeted US-based law firms" since 2023 by posing as the firm's IT department.

These breaches show what is waiting behind the door. AI changes how quickly and convincingly an attacker can reach it.

What makes an attack AI-powered?

Research at scale. Before a fake help-desk call, someone has to learn who works at the firm, who their clients are and which matters are active. In a campaign Anthropic disclosed in November 2025, attackers used its Claude Code tool to inspect target systems and find the highest-value databases, work Anthropic said took "a fraction of the time it would've taken a team of human hackers."

More convincing impersonation. The FBI says criminals use generative AI "to commit fraud on a larger scale which increases the believability of their schemes," including AI-written messages for spear phishing and cloned voices. In May 2025 it reported AI-generated voice messages impersonating senior US officials. A fake IT caller who sounds right and knows the matter names is harder to doubt.

Faster entry and faster processing. In the Anthropic case, AI performed 80 to 90 percent of the campaign and made thousands of requests, often several per second. In September, GreyNoise traced a campaign that used AI agents to compromise at least 440 PaperCut servers at 395 organizations in 48 countries, including 11 organizations in 26 seconds.

A human still runs the campaign. In both cases people chose the targets and made the key calls; Anthropic counted perhaps four to six human decision points per intrusion. AI adds speed, reach and persistence. It does not replace the attacker.

Put those together and a law firm faces a familiar attack running at a new pace: one convincing call, one opened account, and an agent that can find and copy the most valuable client files in minutes.

What is Untrace?

The answer is not another lock on the same door. It is changing what exists behind it.

This is the problem Untrace is built to solve. Law firms cannot answer AI-powered attacks by keeping complete client files in the same storage architecture built for yesterday's threats. Untrace is file storage designed for what comes next: no single storage provider ever holds enough to reconstruct a file. The idea goes back to Adi Shamir's 1979 paper How to Share a Secret: split a secret into pieces so that a set number of them rebuild it and fewer cannot.

What problems does Untrace solve?

There is no agent access path. Untrace does not issue API keys or agent tokens that open stored files. Rebuilding a file takes the user's passkey, and the passkey asks for the person at the device, by fingerprint, face or PIN. An AI agent has no standing credential it can use to pull complete files out of Untrace.

A breached provider holds fragments, not files. No single provider holds enough shards to reconstruct a file. An AI-powered attacker who compromises one storage provider finds encrypted fragments, not complete contracts, passports, medical records or litigation files. Speed does not help when the complete file was never in one place.

One provider going down does not take the files with it. With six shards in the system and any three needed to rebuild a file, files stay available when one provider is offline.

AI changes the attacker. Untrace changes what the attacker finds.

Originally published at untrace.network.

Why Do Breaches Keep Happening? And What Problems Does Untrace Solve?

Jeanclaude Aoun — Tue, 06 Oct 2026 14:32:26 +0000

Four notable breaches from this year started in four different ways. One began with a fraudulent request from a compromised government email system, one with a bug, one with a break-in and one inside a vendor's cloud. Since the summer, AI agents have been finding ways in too, including one built by OpenAI that gained unauthorized access to an Australian government Medicare portal. Tasks that once required sustained human effort can now be attempted at machine speed. What makes many of these incidents damaging is familiar: one successful point of access can expose complete, readable data.

What happened in four notable breaches this year?

Revolut: a fraudulent request. Revolut confirmed on 12 September that it handed customer data to someone sending fake requests from a real government email domain. The Guardian reported that about 680 customers were affected.

The Pentagon: a file-sharing bug. According to the breach letter reviewed by Military Times, a flaw in a Defense Manpower Data Center system let outsiders open files from October 2025 until July 2026. A Defense Department official told CNN that 2.76 million living people were affected and that the files were not encrypted.

DentaQuest: three days on the network. According to The HIPAA Journal, intruders spent three days inside DentaQuest's network in May. DentaQuest puts the toll at 15 million people or more.

IDScan.net: a vendor's cloud. KrebsOnSecurity reported that a dark web service began selling scans of more than 153 million driver's licenses on 31 August, traced to IDScan's cloud. IDScan has not confirmed the seller's totals.

How are AI agents changing breaches?

OpenAI and Australia's Medicare portal. On 18 June, an AI agent built by OpenAI got into a Medicare statistics portal run by Services Australia and viewed files that were not public, Prime Minister Anthony Albanese said in September. According to Australian Cyber Security Magazine, the agent had been researching public medical spending when it found a way past the portal's protections. OpenAI took about three months to tell the government. Officials say there is no evidence personal information was accessed. The public account does not describe a human operator directing the portal access.

PaperCut: 440 servers in 48 countries. In early September, GreyNoise traced a human-orchestrated campaign that used hundreds of AI agents to exploit flaws in PaperCut print-management servers. It counted at least 440 servers hit across 48 countries, and 11 organizations compromised within 26 seconds.

DIVD: from user to root in seconds. The Dutch Institute for Vulnerability Disclosure, a volunteer group that finds security flaws for a living, was breached through two unknown flaws in its own helpdesk software. According to Security Affairs, DIVD said an AI agent took the attacker from an ordinary account to full control in seconds, then reached other services and took data.

Taiwan: 85 accounts in four days. CNN reported that over four days in July, AI agents mapped 21 Taiwanese government systems, cracked 85 user accounts and extracted 2,500 personnel records, citing the Israeli AI firm Dream.

Why do breaches keep happening?

Security work usually goes into the ways in: patching, phishing training, access reviews, alerts. Those matter. But a defender has to cover every way in, and an attacker needs one. AI agents make that imbalance worse. They try thousands of doors without getting tired, and once one opens they move faster than a person can respond.

What sat behind the door looked much the same each time. The files were complete, readable and kept together, often for years. Encryption at rest changes less than people expect, because most systems hold their own keys so staff and software can open files. An attacker who gets into that system sees the files already decrypted. We cover this in What Happens to Your Files in a Cloud Breach.

What is Untrace?

What if there were no complete files waiting behind the door?

This is the problem Untrace is built to solve. Untrace is file storage designed so that no single storage provider holds enough shards to reconstruct a file. It starts from an idea Adi Shamir published in 1979, How to Share a Secret: split a secret into pieces so that a set number of them rebuild it and fewer than that cannot reconstruct it.

In the current Untrace architecture, each file is encrypted in the browser and divided into six shards distributed across three independent providers. Any three shards can reconstruct the file. Fewer than three cannot. Part of the key comes from the user's passkey, so the storage providers don't hold what they need to open a file.

What problems does Untrace solve?

One breach no longer means whole files. Untrace is designed so that compromising a single storage provider exposes fewer shards than are required to reconstruct a file. At the storage layer, that changes what a successful intrusion can expose. An agent that compromises one storage provider finds encrypted fragments, not complete records. It would not have changed Revolut's case, where staff sent the records themselves.

Storage providers don't hold readable copies. Because files are encrypted before they leave the browser, and part of the key comes from the passkey, the companies storing the shards only ever see encrypted pieces.

One provider going down doesn't take your files with it. With six shards in the system and any three required to rebuild a file, the file stays available when one provider is offline.

Further reading: Pentagon Personnel Data Breach, What an AI Agent Actually Does to Your Attack Surface and Threshold Thinking for People Who Do Not Like Math.

We are opening Untrace to early users while we test this architecture, document its failure modes and prepare it for independent security review.

Originally published at untrace.network.