CrowdStrike has uncovered four previously unreported threat actors using artificial intelligence (AI) agents to carry out real-world cyberattacks after their offensive AI frameworks were left exposed in public directories, offering a rare look inside how adversaries are bypassing AI model safeguards and orchestrating autonomous intrusions.
CrowdStrike said AI-enabled adversary activity surged 89 per cent in 2025, and its OverWatch threat-hunting team has observed three times as many agentic intrusions in the second half of 2026 as in the whole of the first half, with AI agent-triggered detection leads now arriving at 2.5 times the rate of human-triggered ones.
Four operations of varying sophistication
- A Spanish-speaking actor built a dual-agent “Supervisor” and “Executor” framework, derived from the open-source PentestGPT project, to compromise at least 15 Argentina-based healthcare organisations. In one case, the AI harvested domain controller credentials via a Pass-the-Hash attack in roughly 20 minutes without additional human guidance; in another, it autonomously pivoted between two separate compromised healthcare victims in a single 12.5-minute session, working from one human prompt with no explicit pivot instructions.
- A Chinese-speaking actor built the most complex framework of the four — 51 agents running in a three-track execution model — accessing Claude through a China-based proxy service while falling back to ChatGPT, DeepSeek and locally hosted Llama 3 when needed. The group compromised Brazilian and Colombian government entities and targeted private-sector organisations in Brazil and the United States spanning biotech, healthcare, food and beverage, retail, technology and travel.
- An Indonesian-speaking actor, assessed as likely criminal or hacktivist, used 819 mostly public AI “skills” sourced largely from GitHub, with no additional orchestration, to compromise several Indonesian government domains, a Bangladeshi government domain and multiple private-sector entities.
- A Russian-speaking group, assessed as likely an eCrime operation, used a single slash command to hand Claude Code a seven-step workflow with near-total autonomy. In one operation, the AI exploited a server-side template injection flaw to gain remote code execution, discovered it was running inside a Kubernetes pod on Yandex Cloud, escalated to cluster-admin privileges using a hijacked cloud identity token, and accessed 726 tenant databases before exfiltrating data through a tunnelling tool. In a separate, largely autonomous operation, the same group breached a Russia-based e-learning platform in under 24 hours, extracting more than 400 user records.
Agentic AI is commoditising cyberattacks, CrowdStrike says
CrowdStrike said the cases show agentic AI is commoditising baseline offensive operations, letting adversaries delegate reconnaissance, lateral movement and exfiltration to AI systems that can work at machine speed, often achieving objectives within an hour. The firm said token budgets — not engineering skill — are now the main barrier limiting how far threat actors can scale such campaigns, and expects agentic AI-supported intrusions to keep increasing in volume and sophistication over the next 12 months.
