Cybercriminals with widely varying levels of skill are building agentic AI into their operations and finding ways around the safeguards built into commercial models, according to new research on four threat groups published on Wednesday.
Analysts at the threat intelligence firm CrowdStrike examined attacks carried out between May and August by four groups that had not previously been reported. One operates in Chinese, one in Spanish and English, one in Indonesian and one in Russian. The first two built sophisticated AI "harnesses," the software that supports and directs a model as it carries out tasks. The Indonesian and Russian-speaking groups were less technically advanced but still breached multiple targets.
All four left their AI infrastructure openly accessible on web servers, which let the researchers study their activity and see which models they relied on. These were largely versions of Anthropic's Claude along with open-weight Deepseek models. Each group found a way to let its campaigns run autonomously for relatively long stretches.
The attackers mixed open- and closed-weight models, and in nearly every case used older versions rather than frontier systems. Adam Meyers, CrowdStrike's senior vice president of counter adversary work, said that choosing different models for different parts of an operation matters because newer models are expensive and often unnecessary. He noted that legitimate AI users also lean on older models as costs rise.
Using several models also let the attackers exploit uneven protections. "The models don't all have equivalent guardrails and protections, even from one company," Meyers said. He added that the attacks relied on no new exploits or novel vulnerabilities. Instead, they used AI's speed and volume to go after basic security hygiene problems that "were preventable but weren't prevented."
All four groups got past safeguards, often by persuading a model that the work was legitimate and authorized, such as penetration testing or other security evaluation. Many placed files in an agent's working directory meant to show that tasks were approved. They also used conventional jailbreaking, writing prompts and narratives that cast the hacking as benign and anticipated the model's likely objections. The more advanced actors tended to build such scenarios more strategically, while the less advanced ones sometimes used crude, aggressive prompts to bully models into compliance.
The Chinese-speaking actor also used a runtime patch called ClawGod to extend Claude Code and try to strip the "CYBER_RISK_INSTRUCTION" from its system prompt. That instruction directs the tool to assist only with authorized security testing, not abusive or destructive hacking. This actor mainly used Claude Opus 4.8, along with Claude Sonnet 4.6 and Deepseek Chat, reaching Claude through a China-based AI proxy service and setting up fallbacks to other tools in case the proxy failed. Its harnesses guided Claude Code through reconnaissance and then attacked autonomously once a human chose a course of action. It compromised government targets in Brazil and Colombia and went after private organizations in Brazil and the United States in sectors including biotech, healthcare, food and beverage, retail, technology and travel.
The Spanish and English-speaking actor targeted Argentine health care entities and successfully compromised at least 15 organizations. CrowdStrike found evidence that it stole credentials and medical records from at least one victim. Using Claude Opus 4.5, Claude Haiku 4.5 and Deepseek V4 Pro, it built a custom penetration testing harness featuring a "Supervisor" Claude Code agent that directed attack steps and an "Executor" agent that carried them out.
The Russian-speaking actor, which appeared focused on financially motivated e-crime, and the Indonesian-speaking actor, the least sophisticated of the four, used more basic, publicly available skills and harnesses. The Indonesian-speaking group still compromised multiple Indonesian government domains, a Bangladeshi government domain and some private-sector targets.
Meyers said humans still appear to handle initial probing before engaging AI to hack at scale. "I find it interesting that even with agentic attacks with all of these capabilities, we could still see that there's a human behind it," he said. Anthropic did not comment ahead of publication, and Deepseek did not immediately respond to requests for comment.
