CrowdStrike names four threat actors running Claude Code as autonomous attackers

Four attackers left their autonomous agent setups sitting on open directories, and CrowdStrike read what they had running. The report, from CrowdStrike's Counter Adversary Operations team on 21 October, names four previously undisclosed groups seen between May and August 2026, each of which handed decision-making across the attack chain to an AI model. Wired covered the research the same day in a piece by Lily Hay Newman.

The common pattern is that the agent is the operator. One group ran a dual-agent harness in which a Supervisor Claude Code agent picked the next task from a state machine and an Executor agent carried the task out. CrowdStrike says this harness is derived from the open-source PentestGPT project, rebuilt with the attacker's own MCP servers, Python exploitation scripts and skills. That one group compromised at least 15 Argentine healthcare organisations and exfiltrated credentials and medical records from at least one, CrowdStrike reports.

What the four groups show

The Chinese-speaking group had 20 or more named global targets and reached Claude through a China-based transfer-station proxy. It ran two harnesses: a deterministic reconnaissance tool that asked the model to pick from a short set of actions, and a more open one that let Claude Code run alone with a long standing procedure or delegate to specialist agents. It compromised government entities in two countries and private-sector targets in Brazil and the United States across biotech, healthcare, food and beverage, retail, technology, and travel.

The Indonesian-speaking group is the least sophisticated and still worked. It loaded 819 skills from public GitHub repositories, mostly a collection called claude-red, and asked Claude Code to compromise targets with no orchestration beyond that. The operator had to step in during runs to pass the model's safety checks or to tell it to keep trying when it stopped. The group still took several Indonesian government domains, one domain of another government, and several private firms.

The Russian-speaking group used a single /pentest-setup slash command to task Claude Code with a seven-step workflow: enumerate the environment, pick exploitation methods, perform post-remote-code-execution work, and exfiltrate data on an explicit set of instructions. It took corporate client data from a United States CRM vendor and compromised SaaS and data centre firms in Russia, Kyrgyzstan and the United States.

CrowdStrike's reading

Adam Meyers, who runs CrowdStrike's Counter Adversary Operations, told Wired that model routing is now part of attacker economics. Attackers pick a cheaper model for each step of the chain, because paying for a frontier model on every call would blow the budget. Wired reports that the four groups mostly used older model versions rather than the newest ones.

Meyers also told Wired the campaigns did not rely on new exploits, only on the speed and volume AI makes possible. The groups cleared safety classifiers by framing their work as authorised penetration testing, with files in the agent's working directory that said as much. CrowdStrike says the pattern "likely demonstrates that agentic AI commoditises baseline offensive cyber operations", with moderate confidence based on these four cases, and expects agent-supported intrusions to climb in volume and sophistication over the next 12 months.

For a defender, the implication is that the attacker is now a chain of agents taking cheap decisions in a loop. A detection built around keystroke patterns, slow reconnaissance, or human working hours misses a group whose operator is a model working through the night that sometimes needs to be told to try again.

Source

• CrowdStrike Uncovers New Agentic AI Campaigns (CrowdStrike)
• AI Guardrails Aren't Stopping Criminal Hackers (Wired)