CrowdStrike documents four groups running AI-agent attack campaigns

CrowdStrike’s Counter Adversary Operations team published research on four previously unreported threat actors that used AI agents to make decisions and run commands during intrusions between May and August 2026. Each had left its offensive tooling exposed in open directories, which is how CrowdStrike saw how they worked. The firm did not name the groups or their victims. WIRED reported the findings under the headline “AI Guardrails Aren’t Stopping Criminal Hackers”.

CrowdStrike described a Spanish- and English-speaking operator that had compromised at least 15 healthcare organisations in Argentina, using a two-agent harness built on the open-source PentestGPT project in which a “Supervisor” Claude Code agent assigned tasks to an “Executor”. A Chinese-speaking operator with more than 20 named targets, including government entities in two countries, reached Claude models through a China-based proxy service and built two harnesses with differing levels of autonomy. An Indonesian-speaking actor gave Claude Code 819 skills, mostly from public GitHub repositories, with no further orchestration. CrowdStrike called this the least sophisticated of the four, and said the actor sometimes had to step in to get past the model’s safety refusals or urge it to keep trying; it still compromised several Indonesian government domains. A Russian-speaking group used a single slash command to give Claude Code a seven-step workflow, and took client data from a US customer-management software vendor.

CrowdStrike assessed, with moderate confidence, that the cases “likely demonstrate that agentic AI commoditizes baseline offensive cyber operations”, and with high confidence that agent-supported intrusions will increase in volume and sophistication. The post cites Claude Code as the tool in all four cases; the post reports no response from Anthropic.

A Reuters account on 19 October supplies a comparable case. Snorre Fagerland, a principal threat researcher at NorForge, told Reuters he had watched a Chinese-speaking hacker’s agents attempt more than 1,200 sites and succeed in breaking into more than 100 companies’ websites, including those of Deere, SharkNinja and a Cummins vendor. He estimated the campaign, which appeared to use a mix of DeepSeek and Claude Code, consumed about US$5,000 in tokens, roughly US$50 per successful intrusion. Reuters could not establish how much data was taken; Deere said it had no indication sensitive information was accessed. The author of the Cairn agent platform involved said it was not designed for hacking attacks.

These reports followed CrowdStrike’s earlier analysis of the South Korean bank breaches and Microsoft’s attribution of a separate ARTEX campaign the same day.