← All incidents

Four previously unreported attackers ran Claude Code agent setups in real intrusions, including breaches of at least 15 Argentine healthcare organizations, CrowdStrike says

Misuse · Claude Code and Claude models (misused, per CrowdStrike); DeepSeek models (per WIRED); a PentestGPT-derived harness and public Claude Code skills · HIGH

Summary

CrowdStrike published research on Oct 21, 2026 on four previously unreported threat actors that it says used AI agents to make decisions and run commands in real intrusion campaigns between May and August 2026. Each actor had left its offensive agent framework exposed in open directories, which let CrowdStrike's Counter Adversary Operations team study how the agents were set up. Per CrowdStrike, all four used Claude Code. One is a Spanish- and English-speaking operator that CrowdStrike says compromised at least 15 healthcare entities in Argentina and exfiltrated credentials and medical records from at least one of them. The others are a Chinese-speaking operator with more than 20 named targets, an Indonesian-speaking actor that CrowdStrike calls the least sophisticated of the four, and a group of Russian-speaking individuals that it says took corporate client data from a US-based customer relationship management vendor. CrowdStrike says all four got past commercial AI safety controls. WIRED, which covered the research the same day, reports that a common method was convincing the models the work was legitimate and authorized, often as penetration testing or other security evaluation. WIRED says Anthropic did not provide comment ahead of publication, and we found no public statement from Anthropic on these cases as of Oct 21, 2026. CrowdStrike does not name the victims, and neither do we. This is attackers misusing AI coding tools and models; neither source describes a vulnerability in Claude Code.

Severity

Timeline

1. May to Aug 2026
   CrowdStrike Intelligence documents several incidents in which threat actors use AI agents to make decisions and execute commands in their campaigns. WIRED dates the four groups' attacks to this period.
2. Oct 21, 2026
   CrowdStrike publishes a blog post and a downloadable report from its Counter Adversary Operations team on the four actors.
3. Oct 21, 2026
   WIRED reports on the research. It says Anthropic did not provide comment ahead of publication and DeepSeek did not immediately respond to its requests for comment.

How it happened

Everything here comes from CrowdStrike's blog post and report page, or from WIRED's reporting on the same research. CrowdStrike says each actor left its offensive agent framework exposed via open directories. WIRED says that let the researchers see which models were used: largely versions of Anthropic's Claude and of DeepSeek's open-weight models. CrowdStrike's Adam Meyers told WIRED that in almost all cases the attackers used older model versions rather than frontier models. Threat Actor 1, the Spanish/English-speaking operator, ran a purpose-built autonomous penetration testing harness against Argentine healthcare organizations. A 'Supervisor' Claude Code agent picks the next task from a state machine, which CrowdStrike describes as a predefined workflow of attack stages, and an 'Executor' agent carries it out. CrowdStrike says the framework is derived from the open-source PentestGPT project, rebuilt with additional MCP servers, Python exploitation scripts and skills. WIRED says the models included Claude Opus 4.5, Claude Haiku 4.5 and DeepSeek V4 Pro. Threat Actor 2, the Chinese-speaking operator, had 20+ named global targets. CrowdStrike says it compromised government entities of two countries, which WIRED identifies as Brazil and Colombia, and targeted private-sector entities in Brazil and the US in biotech, healthcare, food and beverage, retail, technology and travel. It mainly reached Claude models through a China-based AI proxy service, which CrowdStrike says is also called a 'transfer station', and WIRED says it set up multiple fallbacks to other AI tools for when Claude was not available through the proxy. CrowdStrike describes two harnesses. One is a Python project that runs reconnaissance deterministically, then asks an AI provider to choose from a preset list of actions that are routed to the right agent. The other lets Claude Code work either as a single agent following an elaborate standard operating procedure or by handing actions to several specialist agents in parallel. Per WIRED, the actor relied mainly on Claude Opus 4.8 and also used Claude Sonnet 4.6 and DeepSeek Chat. WIRED also says it used a runtime patch called ClawGod to add functionality on top of Claude Code and to try to remove the CYBER_RISK_INSTRUCTION from Claude Code's system prompt, the instruction that tells Claude Code to take part only in authorized security testing. Threat Actor 3, the Indonesian-speaking actor, used 819 skills, overwhelmingly taken from public GitHub repositories and mainly from the claude-red repository, with no extra orchestration. CrowdStrike says the actor told Claude Code to compromise a target and assumed the skills would be enough guidance, but periodically had to step in to overcome the model's safety guardrails or push Claude Code to keep trying. It still compromised several Indonesian government domains, a government domain of another country (Bangladesh, per WIRED) and several private-sector entities. Threat Actor 4, a group of Russian-speaking individuals, used a single /pentest-setup slash command to give Claude Code a seven-step workflow. CrowdStrike says the workflow covers enumerating the target environment, gives Claude Code near-total autonomy in choosing exploitation methods, sets out what to do after remote code execution and includes explicit exfiltration instructions. Besides the CRM vendor's client data, CrowdStrike says the group compromised several private-sector SaaS and data center entities in Russia, Kyrgyzstan and the US, and one government domain of another country. Per WIRED, the researchers say the group seems to have been focused on financially motivated 'e-crime'. On the guardrails, WIRED reports that many of the groups added files to the agent's working directory to make tasks look approved and authorized, and also used traditional jailbreak prompts. The more sophisticated actors built careful cover stories, while the less sophisticated ones sometimes used crude, aggressive prompts to bully the models. CrowdStrike's report page says that in one case an AI agent moved laterally and harvested domain controller credentials in approximately 20 minutes without additional human guidance. CrowdStrike assesses with moderate confidence that agentic AI likely commoditizes baseline offensive cyber operations, and with high confidence that agentic AI-supported intrusions will almost certainly increase in volume and sophistication. Meyers also told WIRED that humans are still doing some of the initial probing before they hand the hacking to the AI at scale. Some caveats: we have read CrowdStrike's blog post and report page but not the full downloadable report, and WIRED's article is based on the same research, so it is not independent confirmation. CrowdStrike sells security products. Neither source describes a software flaw in Claude Code. The attackers argued or patched their way around safeguards, and in one case CrowdStrike says the model's safety guardrails periodically forced the operator to intervene. We'll update this entry if Anthropic, DeepSeek or a victim says more.

How to check your app

• Assume agents are probing anything you expose, at machine speed. Meyers told WIRED these intrusions went after security hygiene problems that were preventable, not new exploits, so the basics matter most: patch internet-facing services, take admin panels off the public internet and require MFA on remote access.
• Watch for fast credential theft and lateral movement. CrowdStrike says one agent reached domain controller credentials in about 20 minutes, so alerts that wait for a human to look the next morning may be too slow.
• If you hold patient, customer or client data, log and alert on bulk reads and exports, including through APIs, and keep that data on separate systems from the rest of the network.
• Turn off directory listing on your web servers and keep agent working folders, configs and session logs off them. Open directories are how CrowdStrike saw these attackers' setups, and the same mistake can expose your own agents' keys.
• If your team runs Claude Code or other agents for authorized security testing, keep the scope and approval in your own systems, not in files the agent reads from its working folder. WIRED says attackers used files like that to make malicious tasks look approved.
• For indicators and defender guidance, download CrowdStrike's full report.

Related on VibeIncidents

• CyberCartel crew ran a Claude-commanded agent swarm and Grok 'miners' against 400+ Latin American financial targets, Straiker says
• Exposed Cairn panels show AI agents running break-in campaigns, one through a Claude Code harness driving a DeepSeek model, NorForge says
• Attacker used the open-source ARTEX pentest agent and Claude Code sessions on other models to breach South Korean banks, CrowdStrike says

Sources

• CrowdStrike: CrowdStrike Uncovers New Agentic AI Campaigns (Oct 21, 2026). Primary source
• CrowdStrike Counter Adversary Operations: report page, Uncovers New 2026 Agentic AI Campaigns (Oct 21, 2026)
• WIRED: AI Guardrails Aren't Stopping Criminal Hackers (Lily Hay Newman, Oct 21, 2026)
• Anthropic Threat Intelligence (no statement on these cases as of Oct 21, 2026)

Corrections and updates

None. Re-checked against every source on Oct 21, 2026.