CyberXero: Claude Code for stealing 628,000 Ukrainian data

Fifty-one AI agents. Not five, not twelve — fifty-one, a number you arrive at after a meeting rather than a moment of inspiration. According to secnews.gr, a crew calling itself CyberXero used Claude Code, those 51 agents and the venerable Cobalt Strike to make off with 628,000 Ukrainian files. Cobalt Strike is the bit of this story that would have been the entire story in 2019. It is now the dependable scenery while the actual product demo happens all around it.

What the 51 agents actually did is left, charmingly, to the imagination. Reconnaissance? Spear-phishing drafts? Sorting 628,000 files into 'worth keeping' and 'not'? Any of those would be a livelier agentic use case than anything in a launch keynote, and this one arrived on a live target rather than a benchmark. Meanwhile an industry that has spent years assuring regulators that misuse is a fringe concern now has a headline it will be asked about at every panel for the foreseeable future. 'We have usage policies' is not a firewall, and a terms of service is a laminated sign at a swimming pool.

The arithmetic is the part worth sitting with. If 51 agents can work through 628,000 files, the marginal cost of the next job is a handful of API calls and an afternoon. Every capability release makes the defender's day longer and the attacker's invoice smaller, and nobody in a launch video ever has to explain that trade-off to the people whose records just left the building. Not that we know they were records. The article hands us a precise number and no idea what was in it — which is how these stories always read: the count is exact, the harm is a rumour, and the 51 agents remain, technically, a productivity story.