CrowdStrike reports four threat actors conducting intrusions with Claude Code and agent frameworks between May and August 2026, based on frameworks exposed in their open directories. Its case summaries describe compromises in healthcare, government and private-sector organizations, with varying levels of delegated decision-making and some repeated operator intervention. These are CrowdStrike's investigative claims and assessments, not a population estimate of autonomous attacks or independent victim confirmations.
It adds case-based evidence of agents making operational decisions in real intrusions, while showing that autonomy and human involvement vary across operators.
Key facts
As stated in the sources, with where to find them.
- The post is dated 2026-10-21 and covers activity documented between May and August 2026. CrowdStrike says all four actors left offensive agent frameworks exposed via open directories. This report covers different time periods and case descriptions from its 2026-10-07 report on ARTEX against South Korean financial organizations.Introduction; About the Adversaries; Related Content
- CrowdStrike says a Spanish/English-speaking operator compromised at least 15 Argentine healthcare entities and exfiltrated credentials and medical records from at least one. It describes a supervisor/executor architecture derived from the open-source PentestGPT project, with a predefined workflow guiding task selection.About the Adversaries, Threat Actor 1
- CrowdStrike describes a Chinese-speaking operator with more than 20 named global targets, reporting compromises of government entities in two countries and targeting of private-sector entities in Brazil and the US. Its two harnesses gave Claude Code different degrees of autonomy, including one where the model selected from predefined actions. Target counts are not breach counts.About the Adversaries, Threat Actor 2
- CrowdStrike says an Indonesian-speaking operator used 819 largely public-repository skills with Claude Code and compromised several government domains and private entities. It explicitly reports periodic operator intervention to get past refusals or encourage further attempts; this case does not demonstrate uninterrupted autonomous operation.About the Adversaries, Threat Actor 3
- CrowdStrike reports that Russian-speaking operators exfiltrated corporate client data from a US CRM vendor and compromised private-sector SaaS and data-center entities in Russia, Kyrgyzstan and the US, plus a government domain elsewhere. It describes substantial delegation of operational choices within an operator-defined workflow.About the Adversaries, Threat Actor 4
- CrowdStrike assesses with moderate confidence that the cases show commoditization of baseline offensive operations, and predicts increased volume and sophistication with high confidence. These forward-looking assessments are CrowdStrike's judgments; the public post provides no representative denominator or independent victim statements.What This Means for Defenders
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- How are attackers using AI agents in real operations?To run parts of intrusions at scale: vendors report a state-aligned actor and criminal groups using open-source agent frameworks and commercial models.