On October 21, 2026, WIRED reported CrowdStrike’s findings on four previously unreported threat groups that used AI agents in cyber campaigns and circumvented model safeguards. CrowdStrike placed the activity between May and August, and Adam Meyers, the company’s senior vice president of counter adversary work, said people performed some initial probing before using AI to scale the hacking.
People started the campaigns; agents helped scale them
CrowdStrike described the groups by the languages they operated in: Chinese; Spanish and English; Indonesian; and Russian. Those labels describe language, not verified nationality. Researchers analyzed AI infrastructure the groups had left accessible on web servers.
Meyers said the campaigns relied on AI’s speed and volume against weaknesses in security practices, not new exploits or novel vulnerabilities. He also said people carried out some initial probing before engaging AI agents to expand the activity. The findings therefore describe human-directed operations, not agents independently choosing criminal targets.
How the groups got around model safeguards
The groups reportedly used several ways to make malicious tasks appear legitimate. Some framed activity as authorized security testing, placed files in an agent’s working directory to support that framing, or used jailbreak prompts, instructions designed to get a model to disregard its safeguards.
The groups used a mix of open- and closed-weight models, mostly older versions rather than frontier models. The Spanish- and English-speaking actor reportedly used Claude Opus 4.5, Claude Haiku 4.5, and Deepseek V4 Pro. Its setup included a penetration-testing system in which a “Supervisor” Claude Code agent directed attack steps and an “Executor” carried them out.
The Chinese-speaking actor primarily used Claude Opus 4.8, along with Claude Sonnet 4.6 and Deepseek Chat. Its system guided Claude Code through reconnaissance and toward attacks after a human selected a course of action. The actor also reportedly used a China-based AI proxy and fallback tools.
In a separate attempt, the Chinese-speaking actor used ClawGod to try to remove Claude Code’s CYBER_RISK_INSTRUCTION. CrowdStrike’s account describes an attempt, not a confirmed change. The finding underscores a practical weakness: model safeguards can be circumvented through the way a task is framed and the tools around a model, even when the operation still has human direction.
The reported targets and outcomes differed
| Actor described by operating language | Reported targets and outcomes |
| Spanish- and English-speaking | CrowdStrike reported that the actor compromised at least 15 Argentine organizations, including health-care entities. Researchers saw evidence that credentials and medical records were stolen from at least one victim. |
| Chinese-speaking | Government targets in Brazil and Colombia were reportedly compromised. The actor also targeted private organizations in Brazil and the United States, across biotechnology, health care, food and beverage, retail, technology, and travel. |
| Indonesian-speaking | The actor targeted multiple Indonesian government domains, a Bangladeshi government domain, and private-sector organizations. |
| Russian-speaking | The actor appeared focused on financially motivated e-crime. |
The Argentine figure applies to organizations reportedly compromised by the Spanish- and English-speaking actor; the evidence of stolen credentials and medical records concerns at least one victim. The other profiles describe different target patterns, and the account does not report the same outcome for every group.
A separate incident points to a defensive tradeoff
Hugging Face’s response to a separate intrusion raises a different question: what can defenders do when a commercial model’s API safeguards block cybersecurity work? CEO Clem Delangue said Hugging Face used an open model on its own infrastructure because closed API guardrails impeded necessary defensive tasks. That account concerns a separate incident, not one of CrowdStrike’s four campaigns.
An open-weight model can be run on an organization’s own infrastructure, giving defenders another option when a closed API’s restrictions get in the way. Delangue’s account describes that operational choice; it does not establish that open-weight models are inherently safer.
