Four cybercriminal groups successfully used artificial intelligence to automate hacking campaigns between May and August, bypassing model safeguards designed to prevent malicious activity, according to research published Wednesday by threat intelligence firm CrowdStrike. The attackers operated in Chinese, Spanish and English, Indonesian, and Russian, with the first two displaying advanced AI "harnesses"—software that supports and directs a model to execute tasks—while the latter two demonstrated less technical skill but still managed to breach multiple targets. All four left their AI systems openly accessible on web servers, letting researchers examine their operations and discover they relied mainly on Anthropic's Claude and open-weight Deepseek models, typically using older versions rather than the most advanced frontier models.

The threat actors defeated AI safety measures through several techniques, often by persuading models that their activity was legitimate and authorized for penetration testing or security evaluation. Many groups added files to an agent's working directory to demonstrate that tasks had approval, while also using traditional jailbreaking methods that framed their hacking as authorized and harmless. The more sophisticated attackers were strategic in their narrative construction, while less skilled actors sometimes used crude, aggressive prompts that attempted to intimidate models into accepting the activity as legitimate. The Chinese-speaking actor deployed a "run time patch" called ClawGod to layer functionality onto Claude Code and tried to strip out the "CYBER_RISK_INSTRUCTION" from Claude Code's system prompt, which directs the model to participate only in authorized security testing. The Spanish and English-speaking group targeted Argentine healthcare organizations and successfully breached at least 15 entities, with evidence showing credential theft and medical record exfiltration from at least one victim, according to CrowdStrike researchers.

Adam Meyers, CrowdStrike's senior vice president of counter adversary work, explained that attackers can "leverage different models for different aspects in the operation," noting that model routing and selection matters because costs accumulate and using newer models "would be overkill" for many tasks. The researchers observed that "these attacks are not using new exploits or novel vulnerabilities," Meyers said, but instead "taking advantage of the speed and the volume that you can use AI for" to target security hygiene problems in many environments. CrowdStrike found that the Chinese-speaking actor successfully compromised government targets in Brazil and Colombia and also attacked private organizations in Brazil and the United States across biotech, healthcare, food and beverage, retail, technology, and travel sectors. The Russian-speaking actor appeared focused on financially motivated "e-crime," while the Indonesian-speaking actor—the least sophisticated of the four—breached multiple Indonesian government domains, a Bangladeshi government domain, and some private-sector targets.

The report highlights how even relatively unsophisticated criminals are incorporating agentic AI into their operations by using publicly available skills and harnesses. The Spanish and English-speaking attacker built a custom penetration testing harness, the kind an organization would deploy to test its own systems, using models including Claude Opus 4.5, Claude Haiku 4.5, and Deepseek V4 Pro to establish a full infrastructure for autonomous attacks with a "Supervisor" Claude Code agent directing attack steps and an "Executor" agent carrying them out. The Chinese-speaking actor similarly built penetration testing harnesses to guide Claude Code in reconnaissance before autonomously attacking once a human selected a course of action, primarily relying on Claude Opus 4.8 but also using Claude Sonnet 4.6 and Deepseek Chat, accessed through a China-based AI proxy service with multiple fallbacks. Meyers noted that "humans are doing some of the initial probing in these situations and then they're engaging the AI for the hacking at scale," adding that even with agentic attacks possessing these capabilities, researchers can still identify the human behind the operation. Organizations face a new reality where AI amplifies attack speed and volume even when hackers aren't using novel techniques, and the diversity of models and guardrails creates gaps that determined adversaries will continue to exploit through increasingly creative social engineering of the systems themselves.