A Chinese-speaking actor tracked as leepsmarts ran AI agents against 20 universities, 19 of them in the US. The actor tasked two frameworks, Hermes Agent and OpenClaw, from a Telegram chat. Only three schools appear as exploit targets, and none is confirmed compromised. The real lesson is how cheaply commodity agents now automate abuse of ordinary university registration and payment flows.
Key takeaways
- leepsmarts, a Chinese-speaking actor, targeted 20 universities (19 in the US). Seventeen are named and three are not.
- The activity splits four ways: reused Harvard data, payment links at five schools, fraudulent accounts at eight, and a staged cPanel exploit at three.
- Harvard's 195 records came from the torrented November 2025 ShinyHunters dataset. The researchers say this was not a new intrusion.
- The operator tasked Hermes Agent and OpenClaw over Telegram to register accounts, watch model releases and build its dashboard.
- The claim of 2,233 harvested LLM keys is unverified because the public summary is truncated at that point.
What did the leepsmarts writeup actually confirm?
Less than the headline numbers suggest. The source is not the primary report. It is a summary that a research team posted to r/threatintel on 4 November 2026, with a parallel post in r/blueteamsec. The summary does not name the research organization. The available text also stops mid-sentence, at the point where it begins describing harvested LLM API keys.
That leaves no IOC list, no technical detail on the cPanel bug, no activity dates and no remediation guidance. Treat the summary as a scoping statement with a victim breakdown. Use the institution names as leads for your own log review, not as proof of what happened inside those networks.
Which universities did leepsmarts target, and how?
The 20 institutions fall into four activity classes, and only one class involves an exploit. Seventeen schools are named. Three are not identified in the available text.
| Activity | Institutions | What it means |
|---|---|---|
| Reuse of leaked data | Harvard | 195 alumni records processed from a torrent; no new intrusion |
| Application payment links generated | Stanford (summer session), UChicago, Wake Forest, Case Western, Central Michigan | Admissions fee workflow driven programmatically; purpose not stated |
| Accounts under fraudulent identities | NYU, UC Berkeley, Oregon State, UIUC, Colorado State, CSU East Bay, CSU Chico, Arizona State | Synthetic identities inside self-service registration |
| Hardcoded exploit targets | University of Utah, Arizona Christian University, UTN Argentina | Staged CVE-2026-41940 cPanel exploit; no confirmed compromise |
The largest cluster is account creation, which is exactly the work agents do well: fill the form, handle the next step, repeat. A fraudulent applicant or student account is rarely the end goal. Depending on the school, it can unlock an institutional email address, academic software discounts, or library and database access. It can also supply an identity that looks legitimate when it contacts staff.
The payment-link activity at five schools is harder to read because the summary never says what the links were for. Two readings fit. Both are our inference, not the researchers’ finding.
The first is card testing, where an actor validates stolen card numbers against a low-value charge such as an application fee. The second is workflow reconnaissance: mapping how far an application gets before money is required. Neither reading is confirmed.
Did leepsmarts breach Harvard?
No. Harvard is in the count because leepsmarts processed 195 alumni records from an already-leaked dataset. The researchers say plainly that this was not an intrusion by this actor. The data came from a torrent tied to the November 2025 incident attributed to ShinyHunters.
We covered that original Harvard alumni data breach when Have I Been Pwned counted 851,000 unique email addresses in the archive that ShinyHunters published. Those records held contact details, donation history and event attendance. They held no passwords or financial data. That profile stays useful to whoever abuses the dataset next.
Once stolen data sits on a torrent, the original theft and every later abuse are separate incidents with separate actors. Harvard does not need to reopen its investigation over this report. Alumni should still expect pretexts that quote real donor or event details, because attackers mine records like these to build convincing identities.
How did leepsmarts run AI agents over Telegram?
The operator ran two AI agent frameworks, Hermes Agent and OpenClaw, and tasked both through Telegram. According to the summary, the agents automated account registration at target institutions. They also watched for new AI model releases and built the actor’s own management dashboard.
Nothing in the summary points to custom malware. Hermes Agent and OpenClaw are general-purpose agent frameworks. The summary gives no version for either one and does not say which models sat behind them. The stack is commodity: anyone who can install an agent framework and create a Telegram bot has the same control plane.
We treat the model-release detail with caution, because the summary gives it one clause and no explanation. One plausible reading, and it is ours, is that the operator swaps in newer models to keep registration working as forms and bot checks change.
The dashboard detail is the sharper one: the agents wrote the operator’s tooling. That closes the gap between a low-skill operator and a working fraud pipeline. It is the same tool and control-loop exposure we map in our piece on the AI agent attack surface.
Telegram works well as a command channel. Bot API traffic goes to a legitimate, TLS-protected endpoint that most egress filters allow, and the operator can task agents from a phone. That traffic will not look like classic C2 in your proxy logs.
Was CVE-2026-41940 used to compromise cPanel at universities?
Not according to the researchers. The University of Utah, Arizona Christian University and UTN Argentina appeared as hardcoded targets in staged exploit code for CVE-2026-41940. The summary states there is no confirmed compromise at any of them. Staging proves intent and preparation, nothing more.
The available text gives no CVSS score, CWE, affected cPanel versions or fixed version, so we will not guess at the bug class. Hardcoding three institutions suggests that the actor had already identified specific cPanel hosts. In university estates, those hosts are often departmental or legacy web servers that central IT does not track.
If cPanel runs anywhere in your estate, check the vendor advisory for CVE-2026-41940 and confirm your build against the fixed release that cPanel lists. Review WHM and cPanel access logs for the period before you patched. WHM login should not be reachable from the internet without an IP allowlist.
How many LLM API keys did the leepsmarts pipeline harvest?
The summary says the same pipeline harvested 2,233 LLM API keys from misconfigured cloud infrastructure, and the public text cuts off right there. Treat the number as reported but unverified. We do not know whose keys they were, which providers issued them, whether they were valid, or how they were used.
Leaked LLM keys are easy to monetize. A thief can resell them, use them to power their own agents, or burn them to inflate the owner’s metered inference bill. For an operator running two agent frameworks around the clock, stolen keys would also double as an operating budget.
This report is not a reason to rotate every key you own. It is a reason to search for LLM provider keys in cloud configuration, environment files, CI variables, public buckets and container images. Revoke any key you find in a reachable place. Then check provider usage dashboards for spend spikes or for calls from unfamiliar regions.
What should university security teams check now?
The useful checks map to the activity classes above, not to indicators.
- Registration funnels. Agent-driven sign-ups look normal at low volume. The indicators are regular timing, identical field-fill order, disposable or newly registered email domains, and shared hosting ASNs across many accounts. Cluster on behavior, not only on per-IP rate limits.
- Admissions payment links. Pull authorization logs from your payment provider. Look for runs of low-value authorizations, links that were generated but never paid, and bursts of links from accounts created the same day.
- Provisioning. List what a brand-new applicant or student account gets automatically: email, SSO into SaaS, library proxy access. A synthetic account inherits every entitlement granted before identity proofing.
- Telegram egress. Search proxy and DNS logs from server subnets for the Telegram Bot API domain. Most university servers have no reason to reach it.
A practitioner’s note: when we test self-service registration and checkout flows, the failure is rarely one bug. It is a chain of individually reasonable decisions, such as no email domain check, an instant SSO grant and an unauthenticated fee endpoint. Together they let a script walk from sign-up to a usable institutional identity.
An agent walks that chain faster and adapts when a field changes. Test the flow end to end, the way API penetration testing treats business logic, rather than control by control.
What is still unknown about the leepsmarts campaign?
Most of what a responder needs is still missing:
- Who published the research, and whether the full report includes IOCs.
- The three unnamed institutions.
- When activity started at each school, and whether it continues.
- What the payment links and fraudulent accounts were used for.
- Technical detail and the fixed version for CVE-2026-41940.
- The source, validity and use of the 2,233 keys.
Until the full writeup surfaces, named universities should treat this report as a prompt to review logs, not as confirmation of a breach.
FAQ
What is the leepsmarts academic fraud campaign?
It is an operation by a Chinese-speaking actor tracked as leepsmarts that targeted 20 universities, mostly in the US. The actor created fraudulent accounts, generated admissions payment links, reused leaked data and staged a cPanel exploit. Two AI agent frameworks controlled over Telegram automated much of the work.
Did leepsmarts breach Harvard?
No. The researchers say leepsmarts processed 195 Harvard alumni records from a torrent of the November 2025 ShinyHunters-linked dataset. They state explicitly that this was not an intrusion by this actor.
Were Hermes Agent and OpenClaw malware?
No. They are general-purpose AI agent frameworks, and the summary describes no custom malware. The operator misused commodity tooling and tasked it through a Telegram bot.
Is there a confirmed cPanel compromise from CVE-2026-41940?
No. The University of Utah, Arizona Christian University and UTN Argentina were hardcoded targets in a staged exploit, and the researchers report no confirmed compromise. Check the cPanel advisory for fixed versions.
Should organizations rotate LLM API keys because of this report?
Not wholesale. The 2,233-key claim has no published detail. Search cloud configs, CI variables, buckets and images for exposed LLM keys, revoke any you find in reachable places, and review provider usage for anomalies.
If your own agents run with tools, credentials and a chat-based control channel, agent::offense can test that chain the way an operator like leepsmarts would. See our AI agent penetration testing service.