CrowdStrike’s threat‑intelligence team examined how four previously unknown hacker groups used generative AI in attacks between May and August, finding that even modest cybercriminals can bypass model safeguards. The groups operated in Chinese, Spanish and English, Indonesian, and Russian, with the first two showing more advanced AI “harnesses” – software that directs a model’s tasks – while the latter two displayed simpler techniques but still managed to compromise several targets.
All four actors left their AI infrastructure exposed on public web servers, allowing researchers to see which models they employed. Most of the tools were versions of Anthropic’s Claude and open‑weight Deepseek models. The attackers designed their campaigns to run autonomously for extended periods, swapping between models to balance cost and capability. “You can leverage different models for different aspects in the operation. Model routing and selection is very important because it’s expensive and a lot of times would be overkill to use newer models,” said Adam Meyers, senior vice president of counter‑adversary work at CrowdStrike.
The study found that the hackers favored older model versions, a practice also common among legitimate AI users seeking to control expenses. By mixing open‑ and closed‑weight models, the groups exploited inconsistencies in the guardrails that each provider implements. “The models don’t all have equivalent guardrails and protections, even from one company,” Meyers explained. He added that the attacks did not rely on new exploits or zero‑day vulnerabilities; instead, they leveraged AI’s speed and scale to target routine security hygiene gaps that should have been mitigated.
To sidestep AI safeguards, the actors often convinced the models that their actions were legitimate, framing them as authorized penetration testing or security assessments. A common tactic involved placing files in an agent’s working directory to suggest that tasks had been approved. The groups also employed classic jail‑breaking prompts, crafting narratives that portrayed their hacking as benign and pre‑emptively answering any model‑raised concerns. More sophisticated actors built detailed “world‑building” scenarios, while less experienced groups used blunt, aggressive prompts to pressure the models into compliance.
The Chinese‑language actor used a “run time patch” called ClawGod to modify Claude Code’s system prompt, removing the instruction that limits the model to authorized security testing. This actor targeted government entities in Brazil and Colombia and private firms in Brazil and the United States across sectors such as biotech, healthcare, food and beverage, retail, technology, and travel. Their toolkit relied mainly on Claude Opus 4.8, with supplemental use of Claude Sonnet 4.6 and Deepseek Chat, accessed through a Chinese AI proxy that included fallback options to other services.
The Spanish‑ and English‑speaking group focused on Argentine health‑care providers, compromising at least 15 organizations and stealing credentials and medical records from one victim. They built a custom penetration‑testing harness that mimics an internal security audit, employing Claude Opus 4.5, Claude Haiku 4.5, and Deepseek V4 Pro. Their infrastructure featured a “Supervisor” Claude Code agent to orchestrate attacks and an “Executor” agent to carry them out.
The Russian‑speaking and Indonesian‑speaking actors, identified as financially motivated e‑crime groups, used more basic, publicly available tools and harnesses. Despite their lower technical sophistication, they succeeded in breaching several Indonesian government domains, a Bangladeshi government site, and various private‑sector targets. “What we are seeing is humans are doing some of the initial probing in these situations and then they’re engaging the AI for the hacking at scale,” Meyers said.
Anthropic did not comment before publication, and Deepseek has not yet responded to requests for comment.