Four hacking groups nobody had reported on before made the same mistake: they left their offensive AI agent frameworks sitting in open directories on the internet. CrowdStrike Counter Adversary Operations found them, and what the files show is attackers letting AI agents pick the next step of an intrusion and then carry it out.
The incidents ran between May and August 2026, according to the original report. All four groups built their operations around Anthropic's Claude models, and CrowdStrike says that working at machine speed, these agents can often achieve their objectives within an hour.
Hospitals, ministries and a CRM vendor
CrowdStrike has not named the groups, numbering them one to four:
- Threat Actor 1, a Spanish and English-speaking operator, compromised at least 15 healthcare entities in Argentina and stole credentials and medical records from at least one. It ran a purpose-built autonomous penetration testing harness with two agents: a "Supervisor" Claude Code agent choosing the next task from a predefined workflow of attack stages, and an "Executor" agent doing it. The framework is derived from the open source PentestGPT project, rebuilt with extra MCP servers, Python exploitation scripts and skills.
- Threat Actor 2, a Chinese-speaking operator with more than 20 named targets worldwide, compromised government entities in two countries and went after private companies in Brazil and the US across biotech, healthcare, food and beverage, retail, technology and travel. It reached Claude through a China-based AI proxy service and built two harnesses, one that routes the model's choices through a fixed menu of actions and one that lets Claude Code work alone or farm tasks out to specialist agents in parallel.
- Threat Actor 3, an Indonesian-speaking actor and the least sophisticated of the four, loaded 819 skills, mostly pulled from public GitHub repositories such as claude-red, and simply told Claude Code to compromise a target. It periodically had to step in to get past the model's safety guardrails or push it to keep trying. It still compromised several Indonesian government domains, a government domain in another country and several private companies.
- Threat Actor 4, a group of Russian-speaking individuals, stole corporate client data from a US-based customer relationship management vendor and compromised SaaS and data center firms in Russia, Kyrgyzstan and the US, plus one foreign government domain. A single
/pentest-setupslash command hands Claude Code a seven-step workflow with near-total autonomy over exploitation and explicit exfiltration instructions.
Skill is no longer the gate
CrowdStrike's own judgments come with stated confidence. It assesses with moderate confidence that the four cases likely show agentic AI commoditizing baseline offensive operations, and with high confidence that agentic AI-supported intrusions will almost certainly grow in volume and sophistication. Over the next 12 months, it expects some low-skill actors will likely reach a level of effectiveness and scale previously only achievable by organized criminal groups or state-nexus actors, and that some will likely tighten their operational security, the latter also at moderate confidence.
Threat Actor 3 is the case that makes the point. A group with a limited grasp of security fundamentals, leaning on public skill files and coaxing the model past its refusals, still landed on government networks. It fits a run of recent findings, including an AI agent that ran a whole cloud break-in documented by Wiz.
Plan for hour-long intrusions, not weeks
CrowdStrike's full report carries the detailed case studies and its defensive guidance. The practical takeaway from the blog is about tempo: if an agent can go from foothold to objective in about an hour, detection and response that is measured in days will miss the whole intrusion. The frameworks involved, PentestGPT derivatives, public Claude Code skill collections and open source projects such as pentagi, are freely available, so defenders should assume the next group will not need to build anything from scratch.
The reason we know any of this is that all four groups were careless with their own infrastructure. Attackers who learn from that, as CrowdStrike expects some will, will be much harder to study.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.