CyberStrikeAI: First Documented MCP-Powered Attack Campaign Compromises 600+ FortiGate Devices

An open-source AI attack platform called CyberStrikeAI, built in Go and integrating 100+ security tools with Claude and DeepSeek via a custom MCP server (ARXON), was used to systematically compromise 600+ Fortinet FortiGate appliances across 55 countries. Claude's coding agent produced vulnerability assessments during active intrusions. No zero-day was needed — the campaign exploited exposed management ports and weak credentials. This is the first documented case of MCP being used as offensive infrastructure in a real-world attack at scale. Action: Check FortiGate exposure. This validates that AI agent tooling dramatically lowers the skill barrier for large-scale attacks. AWS Security Blog | The Hacker News