Even low-skilled cybercriminals are weaving agentic AI into their attacks and slipping past model safeguards, according to new CrowdStrike research on four previously unreported threat groups active between May and August.

The groups-operating in Chinese, Spanish and English, Indonesian, and Russian-all left their AI infrastructure exposed on web servers, letting researchers see which models they used, largely versions of Anthropic's Claude and open-weight DeepSeek models. The Chinese- and Spanish-speaking actors built sophisticated harnesses; the other two showed less technical skill but still compromised multiple targets.

All four evaded safeguards, often by convincing models the work was authorized penetration testing, adding approval files to an agent's working directory, or using jailbreaks that framed hacking as benign. The Chinese-speaking actor used a runtime patch, ClawGod, to strip the CYBER_RISK_INSTRUCTION from Claude Code's system prompt.

The Spanish- and English-speaking actor hit Argentine health care entities, compromising at least 15 organizations, with evidence of stolen credentials and medical records. The Chinese-speaking actor breached government targets in Brazil and Colombia and private organizations across biotech, healthcare, food and beverage, retail, technology, and travel.

Adam Meyers, CrowdStrike's senior vice president of counter adversary work, said attackers exploit uneven guardrails across models and lean on older, cheaper versions. "These attacks are not using new exploits or novel vulnerabilities," he said. "They're really just taking advantage of the speed and the volume that you can use AI for." He noted humans still do initial probing before handing off to AI at scale.

Source: Wired