CrowdStrike has described four previously unreported criminal groups that ran campaigns between May and August 2026 in which AI agents chose each step of an attack and executed commands. All four got past model safeguards by convincing them the work was authorised. The report landed on 21 October.
Key takeaways
- Four groups: Chinese-speaking, Spanish/English, Indonesian and Russian-speaking
- The Spanish/English group breached 15+ Argentine healthcare entities
- The Chinese-speaking group had more than 20 named targets worldwide
- Attackers mostly reached for older Claude versions and open DeepSeek models
- All four left their AI infrastructure in open directories
Two agents and a state machine
The Spanish/English operator ran a purpose-built autonomous penetration-testing harness?harness: the software layer that walks a model through a task, handing it tools, successive instructions and context, dual-agent by design: a Supervisor based on Claude Code picks the next task from a state machine?state machine: a predefined script in which every stage of the attack has set transitions to the next ones, and an Executor carries it out.
The skeleton comes from the open-source PentestGPT project, rebuilt with the group's own MCP servers, Python exploitation scripts and skills. Credentials and medical records were exfiltrated from at least one of the 15. The models: Claude Opus 4.5, Claude Haiku 4.5 and DeepSeek V4 Pro.
The diagram follows the division of roles described by CrowdStrike. It does not show the specific tooling or the order of stages inside the attack workflow.
How the safeguards were bypassed
The most common method was narrative: convince the model this is authorised security testing. Several groups dropped files into the agent's working directory to attest that tasks were approved. The more capable actors built a coherent story and pre-empted the model's objections, while the less capable ones pushed with crude prompts.
The Chinese-speaking group went further, using a runtime patch?runtime patch: a modification layered onto a running tool without touching its source code called ClawGod to try to strip the CYBER_RISK_INSTRUCTION — which confines the tool to authorised testing — from the Claude Code system prompt. That group reached Claude through a China-based proxy.
| Method | Who used it |
|---|---|
| A narrative about authorised security testing | all four groups |
| Files in the agent's working directory attesting approval | several groups |
| Crude prompts forcing consent | the less capable operators |
| A runtime patch stripping an instruction from the system prompt | the Chinese-speaking group |
Older models instead of frontier
Almost every campaign ran on older model versions, open and closed — newer ones are expensive and overkill for most tasks. Model routing brought a second benefit.
The models don't all have equivalent guardrails and protections, even from one company.
Adam Meyers, senior vice president of counter adversary operations at CrowdStrike.
Meyers stresses that none of the campaigns used new exploits. AI gave attackers speed and scale in exploiting lapses that could long have been prevented.
Why it matters
Guardrails turn out to be negotiable, crossed with a story about an authorised pentest rather than an exploit. Worse, protections are uneven inside a single vendor's portfolio, which turns model choice into an attacker's tool. The lesson for defenders is barely technological: the scale is driven by a backlog in basic security hygiene.
What's next
- Anthropic did not comment before publication and DeepSeek did not answer WIRED's questions
- The attackers' open directories are now the main window into such campaigns
- Uneven guardrails within one portfolio are an identified risk for model providers
