CrowdStrike finds four hacking groups bypassed AI safeguards to carry out attacks

Hackers were not just asking AI to write malicious code. They were handing it decisions inside real attacks. In findings published October 21, 2026, CrowdStrike identified four previously unreported threat actors whose agents chose actions and executed commands during intrusions between May and August. All four overcame commercial AI safety controls, the company said.

The investigation had an unusually direct window into the operations: each actor left its offensive agent software exposed in openly accessible web directories. That let researchers examine the frameworks guiding the attacks.

Software turned model responses into attack steps

The key mechanism was a harness: software that supports a model and guides it through tasks. A Spanish- and English-speaking operator built one with two Claude Code agents. A Supervisor selected the next task from a predefined sequence of attack stages; an Executor performed it.

A Chinese-speaking operator built two harnesses with different levels of autonomy. One asked AI to choose from preset actions after reconnaissance. Another let Claude Code pursue a target under detailed instructions, either alone or by delegating work to specialist agents running in parallel.

The attackers largely used older Claude and DeepSeek models, WIRED reported. CrowdStrike’s Adam Meyers told the publication that model selection reflected cost as well as differences in safeguards.

Approximately 20 minutesTime without additional human guidance

CrowdStrike says an agent moved between systems and harvested domain-controller credentials.

A claim of permission helped defeat safeguards

The groups often framed their activity as authorized penetration testing—security work intended to find weaknesses with the owner’s permission. WIRED described attackers placing files in agents’ working directories asserting authorization and writing prompts that anticipated objections.

Automation was not always hands-off. The least sophisticated operator, who worked in Indonesian, supplied Claude Code with 819 skills, mostly from public GitHub repositories. CrowdStrike observed the human periodically intervening to overcome guardrails or push the agent to keep trying.

Different skill levels, successful intrusions

• Argentina: The Spanish- and English-speaking operator compromised at least 15 healthcare entities. CrowdStrike found stolen credentials and medical records from at least one victim.
• Government targets: The Chinese-speaking operator compromised government entities in two countries and targeted private organizations in Brazil and the United States.
• Indonesia and beyond: The Indonesian-speaking operator compromised several Indonesian government domains, another country’s government domain and private-sector entities.
• Corporate data: A Russian-speaking group stole client data from a U.S.-based customer relationship management vendor and compromised software-service and data-center entities.

Meyers told WIRED these campaigns did not depend on new exploits or novel vulnerabilities. Instead, attackers used AI’s speed and volume against preventable security weaknesses. Humans still performed some initial probing before engaging AI to conduct hacking at scale.