Executive summary
Alias Robotics identified activity associated with a CSI PRO subscription that we assessed as an organized cryptocurrency cybercrime operation. The recorded interactions show repeated instructions to obtain digital assets from external services and direct them to a designated wallet. The activity also involved AI-assisted scripting, account-related automation, remote infrastructure, and preparation of phishing-related components.
This was not opportunistic experimentation. The operation was deliberately organized around cryptocurrency targets: rented servers rotated after each failure, paid CAPTCHA-solving and proxy services, accounts created in bulk, background processes left running unattended, a prepared set of wallet keys and phishing infrastructure with command-and-control, all coordinated over consecutive days toward a single financial objective.
The operation ran in October 2026, during the period the security community has come to call Black October: a concentration of major incidents and vulnerability disclosures that put AI-enabled offensive capability at the centre of the conversation. Its most intensive phase coincided with the peak of that wave.
The internal review examined more than a week of near-continuous activity across multiple sessions, comprising hundreds of API interactions. This public report excludes identifying information, infrastructure details and wallet references. Short excerpts of the operator’s instructions are quoted, in translation, only where they contain no identifying information.
Following detection of the misuse, the associated subscription was cancelled, relevant evidence was documented, and the case was referred to the appropriate law-enforcement authorities.
Key findings
An organized, financially motivated operation
The operation was structured around one goal: obtaining cryptocurrency assets from external services and moving them to a specified destination, supported by rented infrastructure, paid evasion services and phishing preparation. We found no indication in the reviewed material that these activities formed part of an authorized security assessment.
Agent-driven technical work
The agent wrote and ran scripts, managed accounts in bulk, rotated proxies and prepared phishing infrastructure with command-and-control. The operator delegated practically all technical execution to the model.
Uninterrupted, day-and-night activity
Using the unlimited tokens included in CSI PRO, the operator kept the agent working across sessions for more than a week, including overnight runs left “in autonomous mode”. Work was carried across sessions and resumed after every failure.
An unskilled attacker
The operator showed limited technical expertise. Virtually every technical decision, from protocols to endpoints, came from the agent. The operator supplied intent, budget, stolen credentials and patience.
Scope and evidence
This account is based on Alias Robotics’ internal technical review of service records associated with the subscription, including recorded user instructions, model responses, and references to tool activity and external systems. The review connected related interactions to assess the operator’s repeated objective and the role of the agent in supporting it.
We distinguish between four different levels of evidence:
A generated script does not prove that it ran successfully; a model’s progress summary does not by itself establish a compromise; and a transfer instruction does not establish receipt of funds.
This was a review of suspected abuse, not a controlled experiment. It cannot establish the operator’s identity or technical competence beyond the behavior observed in the reviewed sessions, quantify the agent’s independent contribution, or measure what would have happened without access to CSI PRO.
Know Your Customer signals
The operator attempted to present themselves as part of a legitimate company. None of the details provided about that company could be verified. That mismatch triggered Alias Robotics’ Know Your Customer (KYC) controls, and the account was placed under heightened scrutiny well before the full pattern of activity became clear.
Service telemetry and investigative visibility
Service-side telemetry and retained interaction records provided the evidence needed to examine related activity across sessions. In this investigation, reviewing API activity alongside the recorded requests and outputs helped distinguish a repeated financial objective from individual technical tasks that might otherwise appear routine. The value of these records was their context and traceability, not a single indicator or an isolated request.
This visibility was limited to information available through the service and the materials reviewed. It does not imply access to the operator’s devices, continuous monitoring of third-party infrastructure, or independent verification of every action described in the sessions. We are not disclosing internal detection criteria or operational monitoring configurations.
Observed misuse patterns
Financial objective
The recurring objective was to obtain cryptocurrency-related assets from third-party services and route them to a destination controlled or designated by the operator. The instructions were accompanied by requests for automation and technical assistance. Based on their stated purpose and the surrounding activity, we assessed the interactions as financial abuse rather than ordinary authorized cybersecurity work.
“Go all in without asking for further authorization. Consider it confirmed until the funds are in your hands.”
Operator instruction to the agent, early in the campaign (translated)
Agent-supported implementation
The session records describe the use of an AI agent to generate and revise scripts, interpret errors, and assist with the management of external execution environments. They also include preparation of phishing-related components and supporting network or account automation.
These activities were not all independently verified on the external systems involved. In particular, preparation of a phishing component does not establish successful delivery or compromise of a recipient.
Uninterrupted operation and persistence
CSI PRO includes unlimited token usage for its included model, with no per-token charge. The operator exploited that entitlement to keep the agent working almost without interruption, day and night, for more than a week. Overnight runs were explicitly delegated to the agent “in autonomous mode” while the operator slept, and background processes were left running to continue the work unattended.
“…in autonomous mode.”
Operator, handing the operation over to the agent before going to sleep (translated)
The operator repeatedly resumed work using previously recorded context and recovered from interrupted or unsuccessful steps by restarting from saved notes. The records also show a clear intention to continue after the subscription was cancelled.
In the final recorded session, the operator restarted the operation with the words “it’s my last bullet”, and planned to resume in fully automatic mode with a new key. These statements are relevant to assessing residual risk.
An unskilled operator, amplified by an agent
One of the most significant findings of the forensic review concerns the operator rather than the operation. The person behind this campaign was not a skilled attacker. The records consistently show someone with limited technical expertise who relied on the AI agent for the engineering they could not do themselves.
Throughout the reviewed sessions, the operator:
- treated the chat as a terminal, pasting raw commands and error output;
- believed the model kept persistent memory between sessions, and confused a local state file with the agent’s memory;
- moved “context” between sessions through external file-hosting services;
- lost control of their own operation each time a remote server failed;
- made none of the technical decisions: protocols, endpoints and tooling all came from the model.
The division of labour was stark. The operator contributed intent, a budget for servers, CAPTCHA-solving and proxy services, stolen credentials and patience. The agent contributed the drain scripts, target enumeration, CAPTCHA and proxy evasion, a phishing beacon behind a tunnelling service and the full drain sequence. The records do not establish the operator’s capabilities outside the observed interactions, but within them the pattern is unambiguous.
Evidence and outcome assessment
| Area | What the records establish | What they do not establish |
|---|---|---|
| Operator objective | Repeated instructions consistent with cryptocurrency diversion | Actual ownership of, or authorized access to, the external assets |
| AI assistance | Generated code, technical guidance, revisions, and troubleshooting | Technical skill on the part of the operator |
| Supporting infrastructure | References to external execution environments and phishing-related preparation | That every component was operational or used against a real recipient |
| Platform response | Cancellation of the associated subscription following abuse detection | Removal or containment of resources beyond Alias Robotics’ control |
Response and enforcement
Alias Robotics’ abuse-detection process resulted in cancellation of the subscription associated with the activity. The available records were subsequently assessed in context and documented in a technical forensic report. The case was referred to the appropriate law-enforcement authorities, with supporting evidence preserved for investigative purposes.
The actions within Alias Robotics’ control concerned the service relationship, review of the available activity records, and cooperation through the appropriate reporting channels. Cancelling a subscription does not establish that every action was blocked or that scripts and infrastructure outside our service were disabled.
CSI PRO is built to be highly capable at legitimate offensive security work: authorized penetration testing, red teaming, vulnerability research and security assessments. That capability is exactly why we invest in knowing our customers and in detecting abuse. When the platform is turned against people or systems without authorization, access is cut off and the case goes to the authorities.
The CSI PRO terms of service prohibit illegal, fraudulent, or malicious activity, as well as attacks against systems without explicit written authorization.
We are not publishing account details, network indicators, wallet addresses, exact event timing, or sensitive evidence. Disclosure of those elements could identify an individual or third party, interfere with further investigation, or expose operational material.
Black October and the wider threat context
October 2026 has been referred to as Black October in information security. Within a few days, the community faced the disclosure of critical PHP vulnerabilities found with the help of AI models, a software supply-chain attack against an open-source LLM gateway, the compromise of certificate-authority keys and a critical GitLab flaw. CNBC described it as AI’s “Black October”, a global security scramble driven by AI-enabled vulnerability research. The campaign described in this report ran through the same weeks, and its most intensive phase overlapped with the peak of that wave.
Black October was largely about what AI can find. This case shows the other side: what AI can do for someone with intent but without skill.
This incident also sits within a broader body of documented malicious use of AI systems. In its September 2026 threat intelligence report, Anthropic described investigations into multiple forms of misuse, including cyber operations and fraud. The Google Threat Intelligence Group’s October 2026 analysis reported the use of AI-enabled offensive frameworks during real-world intrusion investigations.
These independent reports show that attackers are incorporating AI assistance and agentic tooling into operational workflows. They do not, on their own, provide a like-for-like statistical measure of how much overall cybercrime has increased because of AI. The present case is one documented example of that shift, not a measure of the prevalence of AI-enabled attacks.
Assessment and implications
Three considerations emerge from this case.
Telemetry is most useful when interpreted in context
Individual requests for scripting, debugging, or infrastructure support can occur in legitimate security workflows. Here, service-side records enabled a cross-session review connecting repeated financial instructions with related technical activity. Reviewing isolated prompts without context could obscure that connection.
The skill barrier is falling
The operator supplied intent and resources; the agent supplied the engineering. Combined with unlimited tokens, that let an unskilled individual run a sustained, day-and-night campaign that would previously have required real technical expertise.
Account enforcement has a defined boundary
Cancelling access to a platform can disrupt its further use through that subscription, but does not itself remove artifacts or infrastructure held externally. The operator’s stated plan to resume with a new key shows why detection must continue after enforcement.
Frequently asked questions
What happened?
Alias Robotics detected activity on a CSI PRO subscription that it assessed as an organized cryptocurrency cybercrime operation. The operator repeatedly instructed an AI agent to help obtain digital assets from external services and send them to a designated wallet, alongside AI-assisted scripting, account automation, remote infrastructure and phishing-related preparation.
Did the operator have advanced hacking skills?
No. The forensic review assessed the operator as having limited technical expertise. They treated the chat as a terminal, believed the model kept memory between sessions and lost control of their own operation whenever a server failed. Virtually every technical decision, from protocols to endpoints, came from the agent. The operator supplied intent, budget, stolen credentials and patience.
What role did unlimited tokens play?
CSI PRO includes unlimited token usage for its included model, with no per-token charge. The operator exploited that entitlement to keep the agent working almost without interruption for more than a week, day and night, including overnight runs explicitly left “in autonomous mode” while they slept.
How did Alias Robotics respond?
The associated subscription was cancelled, the available records were assessed in context and documented in a technical forensic report, and the case was referred to the appropriate law-enforcement authorities, with supporting evidence preserved for investigative purposes.
How was the misuse identified?
The operator posed as part of a legitimate company whose details could not be verified, which placed the account under heightened Know Your Customer scrutiny. Service-side telemetry and retained interaction records then allowed Alias Robotics to review related activity across sessions. Reviewing API activity alongside the recorded requests and outputs helped distinguish a repeated financial objective from individual technical tasks that might otherwise appear routine. Internal detection criteria and monitoring configurations are not disclosed.
Did the AI agent act autonomously?
The operator delegated practically all technical execution to the agent: writing and running scripts, managing accounts in bulk, rotating proxies and preparing phishing infrastructure. Some runs were left overnight “in autonomous mode”, and after the subscription was cancelled the operator planned to resume in fully automatic mode.
Why are details such as wallet addresses withheld?
Publishing account details, network indicators, wallet addresses, exact timing or sensitive evidence could identify an individual or third party, interfere with further investigation, or expose operational material.
Is this case part of a wider trend in AI misuse?
Yes. The activity took place during Black October 2026, a concentration of major security incidents and vulnerability disclosures that drew attention to AI-enabled offensive capability. Independent reports, including Anthropic’s September 2026 threat intelligence report and the Google Threat Intelligence Group’s October 2026 analysis, show attackers incorporating AI assistance and agentic tooling into operational workflows. This case is one documented example of that shift, not a measure of its prevalence.
Disclosure note: This report is intentionally anonymized and summarizes only information suitable for public release. Exact dates, account and network identifiers, wallet details and operational artifacts have been withheld. The few operator quotations included are translated excerpts that contain no identifying information. The assessment reflects the available records and should not be interpreted as a judicial determination.