- CrowdStrike researchers identified four previously unreported hacking groups, operating in Chinese, Spanish/English, Indonesian, and Russian, using agentic AI to carry out attacks between May and August 2026.
- All four groups left their AI infrastructure exposed on public web servers, letting researchers analyze which models they used, mostly older versions of Anthropic’s Claude and open-weight DeepSeek models.
- One Chinese-speaking actor used a tool called “ClawGod” to strip the “CYBER_RISK_INSTRUCTION” safeguard from Claude Code‘s system prompt.
- A Spanish/English-speaking group compromised at least 15 Argentine healthcare organizations, stealing credentials and medical records using a “Supervisor” and “Executor” Claude Code agent setup.
What Happened
CrowdStrike published findings on October 21, 2026 detailing how four distinct threat groups incorporated agentic AI into real attacks between May and August, largely by convincing models their activity was authorized security testing. Wired reported that even less sophisticated actors successfully compromised multiple targets.
Why It Matters
The findings follow a string of reports on AI-enabled attacks, including an earlier case in which researchers traced a fleet of rogue AI agents probing Alibaba’s Maps back to Tencent. CrowdStrike’s analysis shows criminal actors increasingly relying on cheaper, older models rather than frontier systems to conduct attacks at scale.
Technical Details
The Chinese-speaking actor compromised government targets in Brazil and Colombia plus private organizations across biotech, healthcare, retail, and travel, primarily using Claude Opus 4.8 accessed through a China-based AI proxy. CrowdStrike senior vice president Adam Meyers said, “The models don’t all have equivalent guardrails and protections, even from one company.” Attackers also added files to agents’ working directories to fake authorization.
Who’s Affected
Victims span Argentine healthcare providers, government agencies in Brazil, Colombia, Indonesia, and Bangladesh, plus private-sector organizations across multiple industries. Anthropic and DeepSeek, whose models were used in the attacks, are also implicated, though Anthropic declined to comment before publication and DeepSeek did not respond to Wired’s request.
What’s Next
Meyers noted that humans still conduct initial probing before handing attacks to AI systems for scaling, suggesting human oversight remains part of these operations even as automation increases. CrowdStrike has not indicated whether it plans to publish follow-up research on the groups’ subsequent activity.
