Agents & Coding
CrowdStrike Finds Four Crews Running AI Agents Against Real Targets
One harness hit 15 Argentine healthcare groups; another pulled domain controller credentials in about 20 minutes.
Four previously unreported groups left their agent toolkits where CrowdStrike could find them.
CrowdStrike says it found the agent frameworks of four previously unreported threat actors in open directories between May and August 2026. All four bypassed the safety controls of the models they used, it says.
| Actor | Targets | Tooling |
|---|---|---|
| Spanish- and English-speaking | At least 15 Argentine healthcare entities | A supervisor and executor harness on Claude Code, derived from PentestGPT |
| Chinese-speaking | More than 20 targets, including government entities in two countries | Claude reached through a China-based proxy |
| Indonesian | Indonesian government domains | A toolkit of 819 skills |
| Russian-speaking | A US CRM vendor | Not detailed |
In one case, an agent harvested domain controller credentials in about 20 minutes, CrowdStrike says. WIRED’s headline on the report: AI guardrails are not stopping criminal hackers.
@kimmonismus lists the CrowdStrike findings among the week’s signs that “AI-powered attacks are hitting real organizations.”
Sources
- CrowdStrike · crowdstrike.com
- WIRED · wired.com
- @kimmonismus on X · Oct 21, 10:34 PM PT