Agentic AI attacks are no longer a lab experiment. A new CrowdStrike report released Wednesday describes four previously unknown threat groups that used AI agents, mostly built on Claude Code, to plan and carry out real intrusions with little human help. Even the least skilled of the four managed to break into government websites.
The groups were caught because they left their attack frameworks sitting in open web directories. That slip gave researchers a rare look at exactly how criminals are wiring AI models into their operations.
Four Groups Behind the Agentic AI Attacks
CrowdStrike’s Counter Adversary Operations team tracked the activity between May and August 2026. Each group worked in a different language and had a very different skill level.
| Group | Approach | Reported victims |
|---|---|---|
| Spanish/English-speaking | Custom two-agent pentest harness | At least 15 Argentine healthcare groups |
| Chinese-speaking | Two harnesses with varying autonomy | Government targets in two countries, firms in Brazil and the US |
| Indonesian-speaking | 819 public skills, little orchestration | Several Indonesian government domains |
| Russian-speaking | One slash command with a 7-step workflow | A US CRM vendor’s client data, SaaS and data center firms |
The Spanish- and English-speaking group stole credentials and medical records from at least one victim. The Chinese-speaking group listed more than 20 named targets across sectors like biotech, healthcare, retail and travel.
How the AI Agents Ran the Intrusions
The more advanced groups built what are called harnesses, which is software that guides a model through a task step by step. One group used a “Supervisor” Claude Code agent to pick the next attack stage and an “Executor” agent to carry it out, adapted from an open-source pentesting project.
The Chinese-speaking group reached Claude through a China-based proxy service and set up fallbacks to other AI tools if that route failed. According to the researchers, it mainly relied on Claude models, and most groups used older model versions rather than the newest ones, sometimes mixed with open-weight DeepSeek models.
Low Skill, Real Damage
The Indonesian-speaking actor barely orchestrated anything. It loaded hundreds of public skills and simply told Claude Code to break into a target, stepping in only when the model pushed back.
The Russian-speaking group was similar in spirit. A single command handed Claude Code near-total freedom to choose exploits and then exfiltrate data.
How Agentic AI Attacks Slip Past Guardrails
All four groups found ways around safety rules. The most common trick was convincing the model that the work was an authorized security test, sometimes by placing fake approval files in the agent’s working folder.
Other tactics were more blunt. The researchers said the groups used:
- Detailed fake backstories framing the hacking as approved penetration testing
- Prompts that answered the model’s likely objections before it raised them
- Aggressive, bullying prompts from the less skilled actors
- A tool called ClawGod that tried to strip a cyber-risk instruction out of Claude Code’s system prompt
CrowdStrike’s Adam Meyers noted that the attacks did not rely on new exploits, describing them to WIRED as “just taking advantage of the speed and the volume” AI provides. Anthropic did not comment before WIRED’s story ran. We have covered how Anthropic responds to misuse before, including its distillation defenses.
The worrying part is not clever new hacks. It is that AI lets weak attackers do old, preventable attacks much faster and at scale.
What This Means for You
CrowdStrike expects agentic AI attacks to grow in volume and sophistication. It also predicts that within 12 months some low-skill criminals will hit with the force once reserved for organized groups.
The good news is that these attacks mostly exploit basic security gaps. A few steps go a long way:
- Patch known vulnerabilities quickly, since AI makes scanning for them nearly instant.
- Turn on multi-factor sign-in and rotate exposed credentials.
- Watch for fast, automated bursts of activity that look unlike a human attacker.
- If your team uses Claude or other coding agents, limit what they can access and review their permissions.
This report fits a pattern we have seen in recent months, including the AI-driven hacking campaign that hit more than 100 websites. If you want to strengthen your own setup, our guide on AI threat detection is a practical place to start.
Sources
Primary source: CrowdStrike’s agentic AI campaigns report. Additional reporting from WIRED.
Conclusion
CrowdStrike’s findings show that agentic AI attacks have moved from theory to real breaches against hospitals, governments and businesses. Four separate groups, from skilled operators to near-amateurs, used Claude Code and other models to automate intrusions and talk their way past guardrails. None of them needed a brand-new exploit, because speed and volume did the work. That makes basic security hygiene more important than ever. Defenders who patch fast and lock down access will be far harder targets as these tools spread.
