AI Safeguards Fail to Stop Four Groups Using Agents in Cyberattacks

AI safeguards didn’t prevent four groups from using agent systems to compromise targets between May and August, according to research from CrowdStrike. The incidents show how attackers can combine ordinary security weaknesses with automated reconnaissance and task execution, even without new exploits or the most capable models.

The groups operated in Chinese, Spanish and English, Indonesian, and Russian. CrowdStrike found that all four used AI infrastructure to keep tasks running with varying degrees of autonomy. Their methods ranged from custom software that directed multiple agents to publicly available tools used with less technical skill. The researchers were able to examine the systems because the groups had left their AI infrastructure accessible on web servers.

The findings add detail to a broader shift in AI use by both attackers and defenders. They also illustrate how agentic systems can extend an operator’s reach: a person can make initial decisions, then assign software agents repetitive steps across a target’s systems.

Model choice reflects cost and access

The groups used mostly older versions of Anthropic’s Claude models and open-weight DeepSeek models, rather than relying exclusively on the newest systems. Some used multiple models, switching between them for different tasks. CrowdStrike’s Adam Meyers, senior vice president of counter adversary work, said that model choice matters because using a newer system for every step can be expensive and unnecessary.

That approach resembles ordinary commercial use, where teams may assign less demanding tasks to cheaper or older models. In these cases, model selection also offered a way to work around differences in safeguards. Meyers said protections vary across models, including products from the same company. A safeguard that blocks a request in one system may not prevent similar work from continuing through another.

The research doesn’t indicate that the groups needed novel technical breakthroughs. Meyers said their work relied on existing weaknesses and basic security oversights. AI’s contribution was speed and volume: it helped operators check more systems and automate more steps. That makes routine security practices consequential. A vulnerability that is easy to find but left unaddressed can become easier to exploit when software can search at scale.

Prompts and tools aimed to bypass safeguards

All four groups tried to make their activity appear legitimate to the models. Common tactics included describing the work as authorized penetration testing, adding files to an agent’s working directory as evidence of approval, and writing prompts that anticipated objections from the model. These are variations on familiar prompt-based jailbreak techniques, adapted to systems that can use tools and carry out extended tasks.

The groups differed in how carefully they built that framing. The more technically capable operators constructed detailed scenarios to establish a believable security-testing context. Others used blunt prompts that pressured the model to accept the task as legitimate. In either case, the researchers’ account suggests that safeguards designed to assess individual requests can be challenged by the broader story and files an agent receives.

The Chinese-speaking group went further with a runtime patching tool called ClawGod. It added functionality to Claude Code and attempted to remove a system instruction called “CYBER_RISK_INSTRUCTION,” which directs the tool toward authorized testing and away from harmful activity. The report does not say that this method was used by the other groups.

Custom systems supported longer operations

The Spanish- and English-speaking group built a penetration-testing harness and targeted health care organizations in Argentina. CrowdStrike said the group compromised at least 15 organizations and found evidence that credentials and medical records were taken from at least one victim. Its setup used Claude Opus 4.5, Claude Haiku 4.5, and DeepSeek V4 Pro. A Claude Code agent labeled “Supervisor” directed the work, while an “Executor” agent carried out assigned steps.

The Chinese-speaking group also built harnesses for reconnaissance and further activity. A person chose a course of action before the software continued autonomously. CrowdStrike reported successful compromises among private organizations in Brazil and the United States, across sectors including health care, biotechnology, food and beverage, retail, technology, and travel. The group mainly used Claude Opus 4.8, with Claude Sonnet 4.6 and DeepSeek Chat among its other models. It reached Claude through an AI proxy based in China and prepared alternative tools in case that route failed.

The Russian-speaking group appeared focused on financially motivated cybercrime, while the Indonesian-speaking group was the least technically sophisticated of the four, according to the researchers. Both used more basic, publicly available skills and harnesses. Those simpler setups still proved sufficient to compromise targets, underscoring that custom agent frameworks aren’t a prerequisite for AI-assisted intrusions.

Human direction remains part of the process

Meyers said the researchers saw people perform some initial probing before handing work to AI systems for execution at scale. That division matters when assessing what these systems can do: the reported activity involved human choices, model assistance, and software that carried out tasks, rather than agents independently selecting and pursuing targets.

For defenders, the practical lesson is to treat familiar security gaps as more urgent when attackers can automate discovery and follow-up. The research also raises a challenge for model providers: safeguards need to account for agents’ working files, tool access, and attempts to shift a task across models. The incidents suggest those controls can be tested from several directions, while the underlying weaknesses remain the ones organizations already need to fix.