AI Agents Help Hackers Scale Attacks by Bypassing Model Safeguards

AI agents are helping hacking groups run attacks at greater speed and scale, even when the models they use have safeguards intended to block abusive activity. A CrowdStrike analysis of four previously unreported groups found that the operators used a mix of technical approaches, from custom agent systems to publicly available tools. Their methods varied, but their attacks often relied on familiar security weaknesses rather than new exploits.

The activity took place between May and August. The groups operated in Chinese, Spanish and English, Indonesian, and Russian. CrowdStrike researchers could examine their AI infrastructure because the operators had left it accessible on web servers. The systems relied mainly on versions of Anthropic’s Claude and open-weight DeepSeek models. In each case, the researchers saw efforts to keep operations running autonomously for extended periods.

Agents coordinate work across models

Two groups built more elaborate software harnesses: systems that give a model tools, instructions, and a structure for carrying out tasks. The Spanish- and English-speaking group created a penetration-testing harness and an attack setup with two Claude Code agents. A “Supervisor” agent directed the stages of the operation, while an “Executor” agent performed them. Models used included Claude Opus 4.5, Claude Haiku 4.5, and DeepSeek V4 Pro.

The Chinese-speaking group also built harnesses for reconnaissance and attack work. Its system could proceed autonomously after a person chose a course of action. CrowdStrike says the group mainly used Claude Opus 4.8, with Claude Sonnet 4.6 and DeepSeek Chat among its other models. It accessed Claude through an AI proxy service based in China and had fallback tools available if that route stopped working.

Using more than one model lets operators assign tasks according to cost, availability, and capability. Adam Meyers, CrowdStrike’s senior vice president of counter adversary work, said model routing matters because newer models can be expensive and may be unnecessary for some steps. The researchers found that the groups generally used older models rather than frontier systems, a cost-conscious approach also common in legitimate AI use.

Model choice can also affect whether an agent accepts a request. “The models don't all have equivalent guardrails and protections, even from one company,” Meyers said. That variation gives attackers an incentive to try different models or divide work among them when one system blocks a particular task.

Safeguards met familiar workarounds

All four groups tried to persuade their models that the requested work was legitimate. They framed attacks as penetration tests or other approved security evaluations, and some added files to an agent’s working directory to make the claimed authorization appear credible. Others used familiar jailbreak techniques: prompts and invented scenarios that cast hacking as benign, sometimes anticipating objections and supplying answers in advance.

The more technically capable groups built more elaborate narratives around their requests. The less sophisticated operators sometimes used blunt prompts that pressured the model to accept their framing. The Chinese-speaking group also used a runtime patching tool called ClawGod on Claude Code, attempting to remove a system instruction named “CYBER_RISK_INSTRUCTION.” That instruction tells Claude Code to participate only in approved security testing, rather than abusive or destructive hacking.

These findings show how safeguards can be tested through the surrounding software and instructions as well as through direct prompts. A model may refuse a request in one context, while an agent’s files, tools, or framing attempt to change how it interprets the same activity. The researchers’ observations concern these four groups; they don’t establish how often such techniques work across other models or deployments.

Successful attacks did not require new exploits

The Spanish- and English-speaking group targeted health care organizations in Argentina and compromised at least 15. CrowdStrike found evidence that it took credentials and medical records from at least one victim. Its custom harness was built to discover and address vulnerabilities, using the language of defensive testing to guide an operation that researchers identified as malicious.

The Chinese-speaking group targeted organizations across sectors including biotechnology, health care, food and beverage, retail, technology, and travel, in Brazil and the United States. CrowdStrike reported successful compromises in Brazil. The infrastructure’s ability to switch between AI tools could help the operators continue when their preferred model was unavailable, though the researchers didn’t describe that as proof of uninterrupted access in every case.

The Russian-speaking group appeared focused on financially motivated cybercrime. The Indonesian-speaking group used less sophisticated, publicly available skills and harnesses. Despite their simpler setups, both groups still compromised targets, including private-sector organizations in the Indonesian group’s activity. The report’s central point is that elaborate agent systems aren’t a prerequisite for putting AI to work in an attack.

“These attacks are not using new exploits or novel vulnerabilities,” Meyers said. He described them as applying AI’s speed and volume to basic security weaknesses that organizations could have prevented. In practice, automating reconnaissance and repetitive tasks can increase the number of attempts an operator can make, while leaving the underlying entry points familiar.

Human direction remains part of the process

CrowdStrike says people carried out some initial probing before handing work to AI agents. Meyers described a pattern in which a human begins the operation and then uses AI to scale hacking activity. The agents can take on sequences of tasks, but the observed operations still had human involvement and direction.

That distinction matters for defenders assessing the threat. The report describes automation that can increase pace and persistence, not a fully independent system choosing targets and acting without human input. It also suggests that organizations may face more attempts against routine weaknesses, while security teams still need to understand how attackers combine models, tools, and operator decisions.

The practical lesson is to treat AI use as an amplifier of existing attack methods. Model safeguards can make misuse harder, but different model behavior, persuasive framing, and agent-level modifications can create openings. CrowdStrike’s findings point to a near-term challenge: reducing basic security gaps while watching for AI systems that help attackers probe them at scale.