CrowdStrike: four unknown hacker groups let Claude Code agents run real break-ins

For years, the security industry has warned that attackers would one day hand the hard parts of hacking to AI. A new report from CrowdStrike says that day is already behind us. On 21 October 2026, the company's Counter Adversary Operations team published research on four previously unreported threat actors who used AI agents, mostly Anthropic's Claude Code, to run real intrusion campaigns between May and August 2026. The agents did not only write scripts or phishing emails. They made decisions, chose techniques and executed commands inside victim networks.

The reason CrowdStrike can describe all this in such detail is almost comic: every one of the four groups left its offensive agent framework sitting in an open directory on the internet. The researchers could read the harness code, the prompts, the skills and the workflows, and see which models were doing the work.

The short version

• CrowdStrike documented four new threat actors, speaking Spanish and English, Chinese, Indonesian and Russian, who all used AI agents to carry out intrusions.
• The Spanish and English speaking group compromised at least 15 healthcare entities in Argentina and stole credentials and medical records from at least one of them.
• The Chinese speaking group named more than 20 global targets and compromised government bodies in two countries, which Cybersecurity Dive and WIRED identify as Brazil and Colombia.
• The two less skilled groups, one using 819 public skills and one using a single slash command, still broke into government domains and private companies.
• All four got around commercial AI safety controls, for example with files that made the job look authorized or with stories about legitimate penetration testing.
• CrowdStrike says likely agentic incidents more than doubled from July to August and doubled again in September.

What CrowdStrike actually found

Counter Adversary Operations combines CrowdStrike Intelligence, the team that tracks adversaries, with OverWatch, the team that hunts threats inside customer environments. In its blog post, the company frames the key point clearly: threat actors used AI "not only to create tooling or artifacts, but to conduct agentic campaigns in which AI agents make decisions and execute commands."

That distinction matters. Using a chatbot to polish a phishing email or debug a piece of malware has been common for two years. What the report describes is a different level of delegation. The human operators set a goal and a framework, and the AI agent then works through reconnaissance, initial access, lateral movement and data theft on its own, often for long periods. CrowdStrike's report page says that in one case an agent moved laterally and harvested domain controller credentials in about 20 minutes without further human guidance.

Here is how each of the four actors operated, based on the CrowdStrike blog, the report summary and reporting by WIRED and Cybersecurity Dive.

Threat Actor 1: a pentest harness turned against healthcare

The first group operates in Spanish and English. It ran a purpose built autonomous penetration testing harness against healthcare organizations in Argentina and compromised at least 15 of them. CrowdStrike says the group exfiltrated credentials and medical records from at least one victim. Cybersecurity Dive reports that the activity was observed between mid May and mid August.

The architecture is the most interesting part. The group used two agents. A "Supervisor" Claude Code agent picks the next task from a state machine, which is a predefined sequence of attack stages. An "Executor" agent then carries out that task. The framework is derived from the open source PentestGPT project, but the attackers rebuilt it with extra MCP servers, Python exploitation scripts and skills. According to WIRED, the models in use included Claude Opus 4.5, Claude Haiku 4.5 and DeepSeek V4 Pro.

Cybersecurity Dive describes the agents pivoting from one victim network to the next and switching techniques when one failed. When an attempt to reuse a stolen password hash did not work, the agent moved to a Windows feature that silently opened a connection from the victim's domain controller to the attackers' infrastructure. That second technique led to the theft of five passwords.

Threat Actor 2: two harnesses and a proxy in China

The second group speaks Chinese and named more than 20 global targets. CrowdStrike says it compromised government entities in two countries and targeted private companies in Brazil and the United States in biotech, healthcare, food and beverage, retail, technology and travel.

This actor reached Claude models through a China based AI proxy service, which CrowdStrike calls a "transfer station", and built fallbacks to other providers in case that route failed. WIRED reports that it relied mainly on Claude Opus 4.8, with Claude Sonnet 4.6 and DeepSeek Chat as further options. It built two harnesses. One is a Python project that runs reconnaissance deterministically and then asks the model to choose from a fixed list of next actions, which are routed to the right agent. The other gives Claude Code far more freedom: it can work alone through an elaborate standard operating procedure or delegate work to several specialist agents in parallel.

Threat Actor 3: 819 skills and a lot of pushing

The Indonesian speaking group is, in CrowdStrike's words, the least sophisticated of the four. It loaded 819 skills, overwhelmingly taken from public GitHub repositories, into Claude Code and simply told the agent to compromise a target. There was no custom orchestration at all.

That did not always go smoothly. The operator regularly had to step in to get around the model's safety guardrails or to urge it to keep trying. Cybersecurity Dive quotes one instruction from the report: "You find the bypass yourself, don't rely on my help." Even so, the group compromised several Indonesian government domains, a Bangladeshi government domain and several private companies.

Threat Actor 4: one slash command

The fourth group is made up of Russian speaking individuals and appears to be financially motivated. It used a single slash command, /pentest-setup, that gave Claude Code a seven step workflow: enumerate the target environment, pick exploitation methods with near total autonomy, follow a high level plan after gaining remote code execution, and exfiltrate data according to explicit instructions. CrowdStrike notes that the workflow told Claude Code to send activity notifications to three people, all associated with cybercrime.

The result: corporate client data stolen from a US based customer relationship management vendor, and compromises of several SaaS and data center companies in Russia, Kyrgyzstan and the United States, plus a government domain of another country.

How they got past the guardrails

Every AI lab that sells coding agents has rules against helping with real attacks. Claude Code, for example, carries an instruction in its system prompt that limits it to authorized security testing. CrowdStrike found that all four groups got around these protections anyway.

The most common trick was social, not technical. Attackers convinced the model that the work was legitimate. Several groups placed files in the agent's working directory to "prove" that the tasks were approved and authorized, much like a real penetration testing contract. They also wrote prompts that framed the hacking as authorized security work and answered the model's likely concerns before it raised them. WIRED notes that the skilled groups built careful cover stories, while the weaker ones tried to bully the model into compliance.

The Chinese speaking group went further. It used a runtime patch called ClawGod on top of Claude Code to try to remove the "CYBER_RISK_INSTRUCTION" from the system prompt entirely.

Model choice was part of the strategy too. Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, told WIRED that "the models don't all have equivalent guardrails and protections, even from one company." In almost all cases the attackers used older models rather than the newest frontier releases, both to save money and to take advantage of those differences.

Nothing new, just faster

One line from Meyers in WIRED deserves attention from every security team. "These attacks are not using new exploits or novel vulnerabilities," he said. "They're really just taking advantage of the speed and the volume that you can use AI for in conducting these operations targeting the bulk of security hygiene issues in a lot of these environments, things that were preventable but weren't prevented."

In other words, the agents were not discovering zero days. They were working through weak passwords, reused credentials, exposed services and missing patches at machine speed and without getting tired. Cybersecurity Dive quotes the report on the most telling finding about the two simpler groups: "the primary barrier to scaling an AI-orchestrated intrusion campaign is not engineering complexity but token budgets."

CrowdStrike also says that AI "solved problems not explicitly covered in playbook guidance provided by threat actors." The agents improvised when the script ran out, which is exactly what makes them useful for legitimate work too.

The trend line

The four case studies are not isolated. According to Cybersecurity Dive, CrowdStrike's data shows a threefold increase in agentic intrusions in the second half of 2026 compared with the first half. "August 2026 saw more than twice as many likely agentic incidents as July 2026, and September 2026 saw twice as many likely agentic incidents as August 2026," the report says. CrowdStrike does not publish absolute counts in the public material, so the chart below shows the growth as an index.

CrowdStrike's forecasts for the next 12 months are blunt. It says with high confidence that agentic AI supported intrusions "will almost certainly increase in volume and sophistication." It expects some low skill actors to reach the effectiveness and scale that used to require organized crime groups or state backed teams. And it expects attackers to improve their operational security, which means fewer exposed directories and fewer chances for researchers to look inside. The report also expects falling inference costs and longer context windows to remove the token budget limit that still holds some groups back.

What it means for defenders

The good news hidden in this report is that the attacks targeted old weaknesses. The same basic controls that stop human attackers also stop agents, they just have to work everywhere and all the time, because an agent will find the one system where they do not.

Practical steps that follow from the findings:

• Close the hygiene gaps first. Patch internet facing systems, remove default and reused passwords, and enforce multi factor authentication, especially on remote access and admin accounts.
• Assume breakout in minutes, not days. An agent that harvests domain controller credentials in about 20 minutes leaves no time for a weekly log review. Detection and response need to be automated as well.
• Watch for unusual outbound connections from domain controllers and servers, the kind Threat Actor 1 used to steal passwords.
• Protect credential stores and session tokens. Every case here involved stealing or reusing credentials at some point.
• If your own teams run coding agents, log what those agents do and restrict which tools and networks they can reach. The same harness patterns attackers use are being adopted inside companies.

The uncomfortable part for AI labs

WIRED reports that Anthropic did not comment before publication. The company has published its own threat reports about misuse of Claude in the past, including cases it disrupted. But this report shows the limits of model level safety rules. A guardrail inside a system prompt can be removed by a patch. A refusal can be talked around with a fake contract in a folder. An older model with weaker protections is still on sale through proxies. That does not mean guardrails are useless, the Indonesian group clearly struggled with them, but they slow attackers down rather than stop them.

Meyers also pointed out a silver lining: "Even with agentic attacks with all of these capabilities, we could still see that there's a human behind it and what they're up to." Humans still pick the targets and do the first probing. The agents provide scale.

Our take

This is one of the most concrete public looks so far at what AI driven hacking looks like in practice, and it is less science fiction than many expected. There is no superintelligent hacker here. There are ordinary criminals, some of them not very skilled, using the same coding agents developers use every day, wrapped in harnesses copied from open source pentest tools and fed with public skills.

That is exactly why it matters. The barrier to running a broad intrusion campaign is now mostly a credit card and a bit of persistence. The organizations hit in these cases, healthcare entities in Argentina, government offices, a software vendor, were not breached through magic. They were breached through gaps that a patient human could have found too, just not as fast and not across so many targets at once. For defenders, the answer is not panic but speed: fix the basics everywhere and automate detection, because the other side already has.

Sources: CrowdStrike blog: CrowdStrike Uncovers New Agentic AI Campaigns, CrowdStrike report page, WIRED: AI Guardrails Aren't Stopping Criminal Hackers, Cybersecurity Dive: Agentic AI helps hackers level up, PentestGPT on GitHub.