CrowdStrike finds four cybercrime groups using AI to scale attacks

Older models, divided by task

The four groups varied in sophistication. The Chinese-speaking and Spanish-and-English-speaking groups built more elaborate software around their models; the Russian-speaking and Indonesian groups used simpler public tools and systems. All four still breached targets.

They also selected models according to the job and its cost. CrowdStrike’s Adam Meyers, senior vice president of counter adversary operations, said attackers used both open and closed models, usually older versions rather than the newest ones. That echoes a constraint in legitimate AI projects too: newer models can cost more, and may be unnecessary for a given task.

The groups also mixed models, taking advantage of differences in their safeguards. Even models from the same company can impose different restrictions, Meyers said.

The human behind the agent

Each group tried to persuade models that its work was legitimate, framing attacks as penetration testing or other authorized security checks. Some placed files in an AI agent’s working folder to make tasks appear approved. Others wrote prompts and backstories that cast hacking as harmless, and pre-empted objections the model might raise. The more capable groups planned these scenarios more carefully; the less capable sometimes used blunt prompts.

The Chinese-speaking group used a tool called ClawGod to alter Claude Code at runtime. It added functions and attempted to remove CYBER_RISK_INSTRUCTION, a system-prompt instruction that limits Claude Code to authorized security testing and prohibits malicious or destructive hacking.

The Spanish-and-English-speaking group built an autonomous penetration-testing system using Claude Opus 4.5, Claude Haiku 4.5 and DeepSeek V4 Pro. A Claude Code agent called “Supervisor” managed attack stages, while an “Executor” carried them out. The group attacked medical organizations in Argentina and breached at least 15. CrowdStrike found signs that it stole credentials and medical records from at least one victim.

The Chinese-speaking group used Claude Code for reconnaissance before a person chose a plan for an autonomous attack. Researchers said it breached government targets in Brazil and Colombia and attacked private organizations in Brazil and the United States, across sectors including biotechnology, healthcare, food and beverage manufacturing, retail, technology and tourism. It mainly used Claude Opus 4.8, but also turned to Claude Sonnet 4.6 and DeepSeek Chat, connecting to Claude through a Chinese AI proxy service and preparing alternatives in case the proxy failed.

Anthropic had not commented by publication. DeepSeek had not responded to WIRED’s request by then.

The weak point is still the target

I think the most important detail is that these attacks did not depend on new exploits or unknown vulnerabilities. AI helped the groups find and exploit common security problems that organizations could have prevented. That makes the story less about models breaking through safeguards than about attackers using automation to press on gaps defenders already know how to close.

Meyers said people first conduct reconnaissance, then use AI to scale the intrusion. Even in attacks involving agents with broad capabilities, he said, a person remains behind them, and their activity can be understood. The unresolved issue is whether defenders can identify and fix ordinary weaknesses faster than criminals can use AI to search for them.