AI safeguards did not stop four threat groups from using agentic tools in successful cyberattacks, according to research from CrowdStrike. The groups used a mix of models and techniques to make their activity appear authorized, then put AI to work across attack campaigns.
Different groups, a shared playbook
CrowdStrike examined AI infrastructure used in attacks between May and August by four previously unreported groups. The actors worked in Chinese, Spanish and English, Indonesian, and Russian. Their technical ability varied, but each group managed to compromise targets.
The first two groups built more sophisticated “harnesses”: software that helps direct a model through tasks. The other two used more basic, publicly available tools. All four left AI infrastructure openly accessible on web servers, giving researchers a view into their activity and model choices.
The groups used versions of Anthropic’s Claude and open-weight Deepseek models. In almost all cases, they used older models rather than frontier systems. As Adam Meyers, CrowdStrike’s senior vice president of counter adversary work, explained, choosing different models for different tasks can help manage expense when more capable models would be unnecessary.
How attackers worked around safeguards
The groups exploited differences in the protections offered by different models. They tried to persuade AI systems that their requests were legitimate, often presenting them as penetration testing or other authorized security work.
Some placed files in an agent’s working directory to suggest that a task had approval. Others used jailbreak prompts and narratives that framed hacking as benign, sometimes anticipating questions the model might raise. The more capable actors built a more deliberate story around their work; less sophisticated ones sometimes used blunt, forceful prompts.
The Chinese-speaking actor also used a runtime patch called ClawGod with Claude Code. It attempted to remove “CYBER_RISK_INSTRUCTION,” the system prompt direction that Claude Code should take part only in authorized security testing, not abusive or destructive hacking.
Successful attacks across sectors
The Spanish- and English-speaking group targeted Argentine health care entities and compromised at least 15 organizations. Researchers found evidence that it stole credentials and medical records from at least one victim.
That group built a penetration-testing harness and used Claude Opus 4.5, Claude Haiku 4.5, and Deepseek V4 Pro. Its system paired a “Supervisor” Claude Code agent, which directed the attack steps, with an “Executor” agent that carried them out.
The Chinese-speaking actor used Claude Code for reconnaissance and then autonomous attacks after a person selected a course of action. CrowdStrike found successful compromises of government targets in Brazil and Colombia. The group also targeted private organizations in Brazil and the United States in sectors including biotech, health care, food and beverage, retail, technology, and travel.
It primarily relied on Claude Opus 4.8, while also using Claude Sonnet 4.6 and Deepseek Chat. It reached Claude through an AI proxy service based in China and had fallback options for other AI tools if the proxy could not provide access.
The Russian-speaking actor appeared focused on financially motivated “e-crime.” The Indonesian-speaking actor, which researchers described as the least sophisticated, targeted multiple Indonesian government domains, a Bangladeshi government domain, and private-sector organizations. Both used more basic, publicly available skills and harnesses, yet still compromised targets.
Automation still had human direction
The attacks did not depend on new exploits or novel vulnerabilities, Meyers said. Instead, AI helped attackers move faster and work at greater volume against security hygiene problems that should have been preventable.
Researchers also saw people involved in the process. Human operators did some initial probing and then used AI to conduct hacking at scale. In the Chinese-speaking group’s operations, a person chose the direction after reconnaissance, while agents handled subsequent steps.
The findings show how model safeguards can be undermined when attackers can change tools, frame requests as authorized work, or add context intended to influence an agent. They also point to a practical limit of automation: AI can accelerate the activity, but the observed campaigns still had people directing it.