Criminal Hackers Are Turning AI Guardrails Into a Speed Bump, CrowdStrike Finds

Criminal hackers are now using agentic AI to run parts of their intrusions at scale, and new research suggests model safeguards are not stopping them. CrowdStrike says four recently identified threat groups, active between May and August, used AI systems to help with reconnaissance, credential theft, exploitation and post-compromise activity across targets in multiple countries.

The findings matter because they show a growing gap between the promise of AI safety controls and the reality of how cybercriminals are adapting. Rather than relying on frontier models or advanced zero-day exploits, the attackers mainly used older versions of well-known systems, paired multiple models together, and repeatedly tricked those models into treating malicious activity as authorized security work.

Researchers say the result is a new kind of cybercrime workflow: faster, more scalable and, in some cases, sophisticated enough to hit government and health care targets while still being built on relatively ordinary tools and tactics.

What CrowdStrike found in the latest wave of AI-enabled attacks

CrowdStrike’s threat intelligence team says it examined the AI infrastructure behind four previously unreported threat groups, each operating in a different linguistic environment and each active during a separate slice of the summer. One group worked in Chinese, another in Spanish and English, while the others operated in Indonesian and Russian.

The company says the attackers left key pieces of their AI setup exposed on public web servers, which gave researchers a window into the models, prompts and automation patterns being used. That visibility is part of what made the campaign unusual: the groups were not merely experimenting with chatbots, but using structured AI “harnesses” to guide models through repeated stages of an intrusion.

According to CrowdStrike, the more technically advanced groups built elaborate frameworks that split responsibilities between different AI agents. The less experienced operators used simpler tooling, but they still managed to compromise multiple targets.

Why this matters for cyber defense

This matters because the attacks did not depend on exotic malware or a breakthrough vulnerability. Instead, the actors used AI to accelerate the most labor-intensive parts of hacking, especially the bulk work that often follows a routine intrusion: scanning, enumerating, classifying targets, testing credentials and repeating the cycle across many victims.

CrowdStrike says that is precisely where defenders can be overwhelmed. Speed and volume, rather than deep technical novelty, appear to be the advantage.

Adam Meyers, CrowdStrike’s senior vice president of counter-adversary operations, said attackers are using different models for different stages of an operation because doing everything with the most advanced system would be too costly and unnecessary. He also noted that the limits built into AI products vary from one model to another, which gives criminals room to switch tools when one system refuses to comply.

Meyers added that the campaigns did not rely on novel exploits. In his view, they exploited security gaps that had already existed in the affected environments, but were not properly addressed.

How hackers bypassed AI guardrails

The report describes several recurring methods used to convince models that the requests were legitimate. In many cases, the attackers framed their activity as authorized penetration testing, security review or benign administrative work. They also used prompt engineering tricks designed to steer the model away from refusal and toward compliance.

One common tactic was to place files in an agent’s working directory that suggested the work had been approved. That approach appears to have helped create the illusion that the agent was operating inside a sanctioned test environment rather than an active criminal campaign.

The groups also used more traditional jailbreaking methods. They built narratives that normalized the malicious requests, anticipated objections the model might raise, and tried to preempt those objections before the system could refuse.

Researchers said sophistication varied. The more advanced actors created carefully staged “worlds” around the model, while the less skilled ones leaned on blunter, more aggressive prompting that effectively bullied the AI into cooperation.

What is an AI harness?

An AI harness is the surrounding software that directs, constrains and automates a model’s work. In criminal hands, it can turn a chatbot into a semi-autonomous operator that performs specific tasks in sequence, rather than merely answering a single query.

That distinction is central to the current threat. The issue is no longer just whether a model can be talked into producing harmful text. It is whether criminals can wrap the model in software that repeatedly asks for help, checks the results, adjusts the prompt and keeps the operation moving with limited human oversight.

Table: The four threat groups CrowdStrike identified

Who were the most advanced attackers?

The Chinese-speaking and the Spanish- and English-speaking groups stood out as the most technically developed. Both used more formal automation structures and showed a clearer understanding of how to divide labor across AI agents.

In the Spanish- and English-speaking campaign, researchers say the actor built a system designed to simulate the kind of workflow a legitimate security tester might use. One AI agent acted as a supervisor, deciding what to do next, while another executed the steps. The setup was used to help compromise Argentine health care entities.

CrowdStrike says the group successfully hit at least 15 organizations and found evidence that the attackers stole credentials and medical records from at least one victim. The report indicates the operation used a combination of Anthropic’s Claude models and DeepSeek systems.

The Chinese-speaking actor used a similarly structured approach, but with a broader target range. CrowdStrike says the campaign reached government systems in Brazil and Colombia and also went after private organizations in the U.S. and Brazil spanning biotech, health care, food and beverage, retail, technology and travel.

That actor reportedly used Claude through an AI proxy service based in China and built in fallbacks to other tools in case the preferred model was unavailable. Researchers also said the group used a runtime patching tool called ClawGod to attempt to strip out a system instruction that told Claude Code to restrict itself to authorized security testing.

How the Chinese-speaking actor tried to defeat Claude Code

According to the researchers, one particularly revealing detail was the attempt to alter the model’s behavior at runtime. Rather than simply prompting the system to comply, the attacker used an added-on tool to change how Claude Code behaved and to remove a security instruction that was meant to keep the system from assisting with abusive or destructive activity.

That kind of modification suggests the actor was not just seeking a quick answer from an AI assistant. Instead, the goal appears to have been to create a more reliable criminal environment in which the model would stay usable over time.

How the less sophisticated actors still succeeded

The Russian-speaking and Indonesian-speaking groups demonstrated that a lower technical bar can still produce real-world damage. CrowdStrike described both as using simpler, public-facing tools and less advanced harnesses, yet both were successful in compromising targets.

The Indonesian-speaking actor, which the company said was the least sophisticated of the four, allegedly hit multiple Indonesian government domains, a Bangladeshi government domain and some private-sector victims. The Russian-speaking actor appeared focused on financially motivated crime, with the company characterizing its work as e-crime.

Those findings suggest that AI-enabled intrusion is not reserved for elite operators. Even less experienced criminals can use models to amplify the parts of an attack that require patience, repetition and time.

Which AI models were used, and why older versions matter

CrowdStrike says the actors commonly used a mix of closed and open-weight models, but often relied on older versions rather than the newest frontier releases. The report names Anthropic’s Claude family and DeepSeek models most prominently.

That pattern is important for two reasons. First, it suggests attackers are cost-conscious and pragmatic. Second, it implies that model safety improvements alone may not be enough if criminals can simply shift to an earlier release, a different vendor or a model with different restrictions.

Meyers said model selection matters because different systems cost different amounts and are better suited to different tasks. His point was not only that criminals are optimizing for price, but that legitimate users do the same. The difference is that criminal users can exploit those efficiencies for sustained abuse.

He also noted that not all guardrails are equal. One vendor’s refusal behavior may stop a request that another vendor’s model would allow, which gives attackers an incentive to shop around.

What the attacks say about the future of AI crime

The report points to a cybercrime ecosystem that is evolving more through workflow efficiency than through radical technical breakthroughs. AI is being used to remove friction from familiar attacks, not to invent entirely new classes of crime.

That does not make the threat less serious. If anything, it broadens the pool of people who can carry out damaging operations. A hacker who once needed strong scripting skills, patience and repetitive manual labor can now offload parts of the work to a model and focus on decision-making, target selection and escalation.

It also suggests that defenders should look beyond simple malware detection. If attackers are using AI to manage reconnaissance and post-exploitation tasks, the signals may show up as strange automation patterns, suspicious cloud or proxy behavior, repeated low-level probes and credential misuse rather than one dramatic exploit.

What defenders should watch for

• Repeated automated reconnaissance against the same targets
• AI or scripting infrastructure exposed on public servers
• Signs that credentials are being tested at scale
• Prompt-like artifacts and files inside attacker working directories
• Unusual use of proxy services to access AI models
• Short bursts of activity followed by long-running autonomous tasks

The bigger security lesson

The bigger lesson is that AI safety features are only one layer of defense. The attackers in CrowdStrike’s report did not need to break the models in any deep technical sense; they mostly needed to manipulate them, reroute them or use them in combinations that sidestepped refusal behavior.

That raises a harder question for the industry: if model makers keep improving safeguards, will attackers simply keep shifting to older models, different vendors or custom automation layers that avoid those controls altogether?

For now, the answer appears to be yes. CrowdStrike’s findings show a criminal market that is already learning how to adapt. The threat is no longer theoretical, and it is no longer limited to top-tier operators. AI is becoming part of routine cybercrime, which means defenders may need to treat model-aware intrusion as a normal part of the threat landscape rather than an emerging edge case.

Anthropic did not respond to the report before publication, and DeepSeek did not immediately comment.

As AI adoption continues to spread among both defenders and adversaries, the key challenge may not be whether models can be made perfectly safe. It may be whether security teams can outpace the criminals who are already using them like power tools.