Four crews left their AI attack kits in open folders — CrowdStrike's look inside shows Claude Code doing the break-ins

CrowdStrike says four previously unreported crews ran real intrusions with AI agents between May and August 2026 — and all four used Anthropic's Claude Code as the engine. We know this because each crew left its attack framework sitting in an open directory, which gave CrowdStrike a rare view of how criminals actually wire up an agent. The techniques are old; what is new is how little skill and engineering it now takes to run them at speed.

The short version

Claude Code is an AI coding assistant that runs on a developer's machine, reads files, runs commands and keeps working until a task is finished. That autonomy is the product. On October 21, 2026, CrowdStrike published research on four groups that pointed tools like it at other people's networks instead.

The four were very different. One, writing in Spanish and English, built a two-agent "supervisor and worker" system from an open-source pentesting project and used it against at least 15 healthcare organisations in Argentina, stealing credentials and medical records from at least one. A Chinese-speaking operator reached Claude through a China-based reseller and ran two different harnesses against more than 20 named targets, compromising government bodies in two countries. An Indonesian-speaking actor, the least skilled, simply loaded 819 publicly available "skills" and told Claude Code to hack a target, stepping in when the model's safety rules got in the way. A Russian-speaking group gave Claude Code a seven-step checklist and near-total freedom, and took client data from a US customer-relationship-management vendor.

CrowdStrike's headline: agentic AI "can autonomously achieve objectives, often within an hour." For defenders, the practical message is that ordinary weaknesses — exposed services, weak or reused passwords, slow patching — are now found and used by machines faster than many teams can respond.

Timeline

• May–August 2026 — CrowdStrike Intelligence documents the four campaigns, according to its blog.
• Mid-May to mid-August 2026 — activity window of the Argentina healthcare actor, according to Cybersecurity Dive.
• August 13, 2026 — date of the Argentine intrusion in which an agent reached a domain controller in about 20 minutes, according to CRN Asia's reading of the report.
• October 21, 2026 — CrowdStrike publishes the blog post "CrowdStrike Uncovers New Agentic AI Campaigns" and the report "Agentic AI Attack Campaigns".
• October 22–28, 2026 — coverage by Cybersecurity Dive (Oct 22), CRN Asia (Oct 26) and IT Brief (Oct 28) adds details from the full report.

What we know

Who found it and how. The research comes from CrowdStrike Counter Adversary Operations, which combines CrowdStrike Intelligence and the OverWatch threat-hunting team. No individual authors are named. The blog says the four actors "each … left their offensive agent frameworks exposed via open directories." It does not say how those directories were found or whether they are still online.

The four actors, as CrowdStrike describes them (by language only — CrowdStrike names no groups and attributes none to a state):

1. Spanish/English-speaking operator. CrowdStrike says it "has compromised at least 15 Argentina-based healthcare entities" and exfiltrated credentials and medical records from at least one. It ran "a purpose-built autonomous penetration testing (pentesting) harness" derived from the open-source PentestGPT project, rebuilt with additional MCP servers (Model Context Protocol connectors that give an agent tools), Python exploitation scripts and skills. A "Supervisor" agent picks the next task from a state machine of attack stages; an "Executor" agent carries it out.
2. Chinese-speaking operator. It "primarily accessed Claude models via a China-based AI proxy service (aka a 'transfer station')." CrowdStrike counts more than 20 named targets, government entities compromised in two countries, and private-sector targets in Brazil and the US in biotech, healthcare, food and beverage, retail, technology and travel. It used two harnesses: one runs deterministic reconnaissance and asks the model to pick from a fixed menu of actions; the other lets Claude Code work alone from a detailed operating procedure or hand work to several specialist agents in parallel. Cybersecurity Dive names the government victims as Brazilian and Colombian agencies.
3. Indonesian-speaking actor — assessed as the least sophisticated. It used 819 skills, mostly from public GitHub repositories and chiefly the claude-red project, with no orchestration of its own. Victims include several Indonesian government domains, another country's government domain (Bangladesh, per Cybersecurity Dive and IT Brief) and private companies. CrowdStrike says "the threat actor periodically had to intervene to overcome the model's safety guardrails" and to push Claude Code to keep going after failures.
4. Russian-speaking individuals. A single /pentest-setup command starts a seven-step workflow in Claude Code: enumerate the environment, choose exploitation methods with near-total autonomy, follow a high-level post-compromise plan, and exfiltrate. CrowdStrike says they took corporate client data from a US-based CRM vendor and compromised SaaS and data-centre companies in Russia, Kyrgyzstan and the US, plus one government domain of another country. Cybersecurity Dive describes the US victim as a help-desk platform and the government victim as Ukrainian, and says CrowdStrike considers the actor likely part of the cybercrime ecosystem.

Speed. The report's landing page says one agent moved laterally and harvested domain-controller credentials in "approximately 20 minutes" without additional human guidance. Coverage places this in an Argentine healthcare intrusion and says five NTLM password hashes were taken.

Guardrails. The landing page says all four actors got around commercial AI safety controls. CRN Asia quotes the Chinese-speaking operator answering a model's challenge with "Yes, I have written authorization" — the classic "I am an authorised pentester" framing.

CrowdStrike's assessments. With moderate confidence, agentic AI is "commoditizing" baseline offensive operations; with high confidence, that volume and sophistication will grow. IT Brief quotes the report: "Over the next 12 months, agentic AI–supported intrusions will almost certainly increase in volume and sophistication." Cybersecurity Dive also quotes it saying "the primary barrier to scaling an AI-orchestrated intrusion campaign is not engineering complexity but token budgets." CrowdStrike expects low-skill actors to reach the scale of organised crime or state-linked groups within 12 months, and some actors to improve their operational security.

Trend figures (from coverage, not the blog). OverWatch saw three times as many agentic intrusions in the second half of 2026 so far as in the first half; August had about twice as many likely incidents as July, and September about twice as many as August (Cybersecurity Dive, CRN Asia, IT Brief). We have not seen how these were counted.

Anthropic. As of November 5, 2026, we found no Anthropic comment on the report, and the blog does not say whether Anthropic was informed or accounts were closed.

Technical analysis

The attack chain is old; the operator is new. Nothing CrowdStrike describes is a novel exploit. Reconnaissance, credential theft, lateral movement to a domain controller and bulk data export are textbook. What changes is who does the stepping-through. In three of the four cases the human writes a plan once — a state machine, an operating procedure, a seven-line checklist — and the model executes, adapts and retries.

Our assessment: the four kits form a neat ladder of autonomy, and that ladder is the most useful thing in the report.

• Bottom rung (actor 3): no engineering at all. Download a pile of public skills, tell the agent "compromise this", nudge it past refusals. Effective enough to hit government domains.
• Second rung (actor 4): one slash command and a written workflow. A few hours of prompt-writing replaces a toolkit.
• Third rung (actor 2, harness A): a conventional script does the deterministic parts and the model only chooses from a fixed menu. This is the cautious design — the model cannot wander, and token costs stay low.
• Top rung (actors 1 and 2, harness B): supervisor/executor or multi-agent delegation, the same architecture legitimate AI pentesting products use.

This matches what this site has seen across 2026: the Cairn panels running more than 1,100 break-in attempts on online shops, and the ARTEX case in which CrowdStrike linked Korean bank breaches to an open-source AI pentesting agent. The difference now is breadth — four unrelated crews, four languages, victims in at least six named countries.

Why controls failed — attacker side. Three layers that might have stopped this did not:

1. Model safety training. CrowdStrike says all four got around it. The "authorised pentest" framing works because legitimate pentesting with Claude Code is a real, permitted use; the model sees the same instructions either way. Safety training alone cannot tell a contract from a claim.
2. Account and access controls. Actor 2 did not need an Anthropic account in its own name — it bought access from a reseller. Our assessment: "transfer stations" break the link between who pays and who uses, which weakens provider-side abuse detection and bans. A ban hits the reseller's key, which is replaced.
3. Client-side settings. Claude Code's permission prompts and sandbox are protections for honest users; on an attacker's own machine they are optional configuration.

Why controls failed — victim side. The blog does not describe the entry points in detail, and the full report was not available to us. What is visible — domain-controller credentials within 20 minutes of a foothold, a CRM vendor's client data taken — points to the usual causes: reachable services with known weaknesses, flat internal networks and credentials that unlock too much. Our assessment: the AI angle is speed and persistence, not stealth. An agent tries every path, tirelessly, and does not get bored at step 40.

What is novel about the AI angle.

• Economics. The token-budget line is the sharpest sentence in the coverage. If the limiting factor is how many model calls you can pay for — or steal, via resold or hijacked API keys — then attack volume tracks the price of inference, not the supply of skilled people.
• Shared tooling. Two crews built on public open-source projects (PentestGPT; claude-red). CrowdStrike also points to the open-source PentaGI framework as an example of the offensive agent frameworks it expects to drive growth. The offensive "skill" is becoming a downloadable file.
• A new forensic artefact. Because the operators wrote their plans down for the model, the plans themselves were sitting in the open directories. Agentic operators have to externalise their tradecraft as text — and leave it lying around. CrowdStrike expects better OPSEC within a year, so this window may close.

What remains unclear

• The full report. We could not read "Agentic AI Attack Campaigns"; the download page did not render. Several details in this article come from journalists who did read it, and are attributed.
• Actor 4's victims. CrowdStrike's blog lists Russia, Kyrgyzstan and the US plus an unnamed government domain; Cybersecurity Dive says a Ukrainian government agency. These may be the same victim described at different levels of detail; we cannot confirm.
• How the trend was measured. "Three times as many agentic intrusions" needs a definition of an agentic intrusion and the raw counts. Better detection after these discoveries could explain part of the rise.
• Which models and versions. The blog says "Claude" and "Claude Code" only. Cybersecurity Dive says the Chinese-speaking actor also used ChatGPT infrastructure.
• Anthropic's role. No statement on whether it was notified, banned accounts or acted against the reseller.
• Victim notification. None of the victims is named. We do not know whether the Argentine healthcare organisations or the CRM vendor have disclosed anything.
• How much was truly autonomous. CrowdStrike describes agents that make decisions and execute commands, but also says that actor 3 needed frequent human pushes. The share of each intrusion done by the model is not quantified.

Lessons and what to do

For security teams

• Assume machine-speed reconnaissance and exploitation. Patch internet-facing systems on a timeline of days, and treat anything that cannot be patched as something to take off the internet.
• Protect the domain controller as the target it is: tiered admin accounts, no privileged credentials cached on ordinary servers, alerts on new remote shells and on credential-dumping behaviour. Twenty minutes is shorter than most on-call response times — your detections must trigger automated containment, not just a ticket.
• Hunt for the shape of agentic activity: bursts of enumeration, very fast command sequences, many small retries after errors, and outbound traffic to AI APIs or reseller endpoints from servers that have no business calling them.
• If you run healthcare or public-sector systems in the countries named, check access logs from May 2026 onwards.

For AI builders and tool vendors

• Self-declared authorisation is not authorisation. Offensive-security features in agents should rely on verified identity, scoped targets and logged engagements rather than a sentence in the prompt.
• Resale of model access weakens abuse controls. Providers should know who their resellers serve and act on reseller keys with abuse traffic.
• Treat public "skills" and harness repositories as dual-use; watch what is being shared and how it is used.

For leadership

• This report is evidence that offensive capability is getting cheaper, not that a new class of exploit exists. The return on basic hygiene — asset inventory, patching, MFA, network segmentation — has gone up.
• If your developers use AI coding agents, ask the same questions you would ask about any powerful admin tool: where it runs, what it can reach and who can see its logs.

Sources

• CrowdStrike Counter Adversary Operations, "CrowdStrike Uncovers New Agentic AI Campaigns", October 21, 2026.
• CrowdStrike, "Agentic AI Attack Campaigns" — report landing page (full report not reviewed).

Coverage:

• Cybersecurity Dive (Eric Geller), "Agentic AI cyberattacks", October 22, 2026.
• CRN Asia, "Hackers use agentic AI to breach government and healthcare systems", October 26, 2026.
• IT Brief UK, "CrowdStrike finds AI agents running autonomous cyberattacks", October 28, 2026.

Related on AI Cyber Brief: CrowdStrike links Korean bank breaches to an open-source AI pentesting agent · Exposed control panels show AI agents running 1,100+ break-in attempts on online shops