CrowdStrike documents four agentic-AI hacking campaigns

CrowdStrike said it identified four previously unreported threat actors using AI agents to make decisions and execute commands during intrusion campaigns observed between May and August 2026. The cybersecurity company linked the activity to alleged compromises of healthcare, government, software and data-center targets. It did not name the affected organizations, and the claims have not been independently confirmed.

In the company’s account of the campaigns, the attackers moved beyond using chatbots for advice. Their systems could choose tasks, run tools and pass work among specialized agents during an intrusion. CrowdStrike said all four groups exposed parts of that infrastructure through open web directories, allowing its researchers to inspect their workflows and model use.

The disclosure follows a separate CrowdStrike account linking ARTEX and LLMs to South Korean finance intrusions. The new report focuses on four agent workflows observed later in 2026.

According to CrowdStrike, one Spanish- and English-speaking actor used a two-agent system against healthcare organizations in Argentina. A supervisory Claude Code agent selected each next task from a state machine, and an executor agent carried it out. The framework was derived from PentestGPT and expanded with Model Context Protocol servers, Python exploitation scripts and reusable skills. CrowdStrike said the actor compromised at least 15 healthcare entities and removed credentials and medical records from at least one victim. No victim or regulator confirmation was identified in the research reviewed for this article.

CrowdStrike said a Chinese-speaking operator used two setups. One ran a predetermined reconnaissance sequence, then asked an AI provider to select among preset actions routed to agents. The other let Claude Code act alone or delegate steps to specialist agents working in parallel. CrowdStrike said the operator maintained a list of more than 20 targets, compromised government entities in two countries, and targeted private-sector organizations in Brazil and the United States. Its open blog did not identify the two governments, and the alleged compromises remain unconfirmed by the affected entities.

An Indonesian-speaking actor used 819 skills, mostly sourced from public GitHub repositories, without an additional orchestration layer, CrowdStrike said. The operator periodically intervened when safety controls or other obstacles stopped the system. CrowdStrike attributed compromises of several Indonesian government domains, a government domain in another country and several private-sector organizations to the actor, but did not name the entities.

The fourth case involved Russian-speaking individuals who used a single command to start a seven-step Claude Code workflow, according to CrowdStrike. The process covered target enumeration, autonomous exploit selection, activity after remote-code execution and instructions for data exfiltration. CrowdStrike alleged that the group removed corporate-client data from a U.S. customer-relationship-management vendor and compromised software-as-a-service and data-center entities in Russia, Kyrgyzstan and the United States, as well as a government domain elsewhere. It did not identify those organizations.

A separate CrowdStrike report page says all four actors overcame commercial AI safety controls. It also says that, in one case, an agent moved laterally through a network and collected domain-controller credentials in about 20 minutes without further human direction. The page does not identify the victim, and the claim has no independent confirmation in the reviewed sources.

CrowdStrike treated its outlook separately from those case findings. The company forecast with high confidence that agentic-AI-supported intrusions will almost certainly grow in volume and sophistication. It also projected that, over the next 12 months, some low-skill actors will likely reach levels of effectiveness and scale previously associated with organized criminal or state-linked groups, while some operators will likely improve their operational security.