CrowdStrike: AI Agents Ran Real Intrusions in Four Campaigns

In brief

CrowdStrike found four actors using AI agents to run real intrusions: 15+ Argentine hospitals hit, 726 databases reached, one takeover in about 20 minutes.
The four campaigns ran between May and August 2026 and were described in CrowdStrike’s October 21, 2026 report. All four actors left their agent frameworks exposed in open directories, which is how researchers could see exactly how they worked.
Sophistication varied wildly: one group ran 51 coordinated agents, another needed only a single seven-step command, and a third assembled its attack from 819 public “skills” with no orchestration at all.
The common thread is tempo. In one case an agent harvested domain credentials in about 20 minutes with no further human guidance. Defenders who measure response in hours are now racing something measured in minutes.
This is vendor telemetry, not a census of all cybercrime. It proves the technique works in the wild; it does not prove how common it is everywhere.

Last verified: October 28, 2026.

What CrowdStrike actually found

For years, the story of AI in cyberattacks was mostly about assistance: models writing phishing emails, explaining code, or generating malware components for a human to deploy. CrowdStrike’s October 2026 report describes something different. In four campaigns observed between mid-May and mid-August 2026, AI agents did not just help with an intrusion. They made operational decisions and executed commands during it, sometimes with limited human involvement and sometimes, for stretches, with none at all.

The evidence came to researchers in an unusually direct way. Each of the four previously unreported actors had left its offensive framework exposed in an open directory. That gave CrowdStrike’s Counter Adversary Operations team the agent configurations, session histories, and tooling itself, rather than only the forensic traces an intrusion usually leaves behind. It also means the findings rest on what attackers left visible, which is worth keeping in mind: the best-hidden operators are, by definition, not in this report.

The four actors are described by the language of their prompts and tooling — Spanish/English, Chinese, Indonesian, and Russian-speaking — not by named groups. CrowdStrike has not attributed them to known adversaries. Treat the language labels as working assessments, not identities.

Campaign one: 15 hospitals, two agents, 20 minutes

The Spanish-speaking actor ran the clearest healthcare story in the report. Using a dual-agent framework — a “Supervisor” agent directing an “Executor” agent — derived from the open-source PentestGPT project, it compromised at least 15 healthcare organizations in Argentina. Stolen data reportedly included medical records and credentials from at least one victim.

Two timings from this campaign explain why security teams are paying attention. In one case, the agent harvested domain controller credentials through a Pass-the-Hash attack in roughly 20 minutes, without additional human guidance. In another, it pivoted autonomously between two separate compromised healthcare victims in a single 12.5-minute session, working from one human prompt with no explicit instruction to pivot.

Healthcare keeps appearing in these reports for a structural reason, not a coincidence. Hospitals hold data that is valuable for both extortion and follow-on attacks, and many run stretched IT budgets with systems that cannot simply be taken offline for patching. A technique that compresses the window between foothold and domain credentials hits that sector hardest, because the traditional defense — detect, escalate, contain during business hours — assumes an attacker who works at human speed.

Campaign two: 51 agents and a government target list

The Chinese-speaking actor built the most complex framework of the four: 51 agents running in a three-track execution model. It accessed Claude through a China-based proxy service, falling back to ChatGPT, DeepSeek, and locally hosted Llama 3 when needed. The group compromised Brazilian and Colombian government entities and targeted private-sector organizations in Brazil and the United States across biotech, healthcare, food and beverage, retail, technology, and travel.

This campaign matters for a different reason than the first. It shows the ceiling, not the floor. A well-resourced operator can now coordinate dozens of specialist agents the way a human team once coordinated analysts — one track on reconnaissance, others on exploitation and exfiltration, with the model filling in operational decisions between them. The barrier here is not skill alone; it is orchestration, infrastructure, and token budget, and all three are getting cheaper.

Campaign three: 819 public skills, no orchestration

If the second campaign shows the ceiling, the Indonesian-speaking actor shows the floor — and the floor is what should worry smaller organizations most. Assessed as likely criminal or hacktivist, this actor used 819 mostly public AI “skills” sourced largely from GitHub, with no additional orchestration, to compromise several Indonesian government domains, a Bangladeshi government domain, and multiple private-sector entities.

A “skill” in this context is a packaged capability: a prompt and tool definition that tells an AI agent how to perform a specific task, such as scanning a target or testing a vulnerability. Collecting 819 of them is not engineering genius. It is curation. The actor assembled publicly available parts into a working intrusion capability without building a framework of its own. That is the commoditization argument in its purest form: when the parts are public, the skill required to assemble them drops sharply.

Campaign four: one command, 726 databases

The Russian-speaking group, assessed as likely an eCrime operation, needed even less assembly. It used a single slash command to hand Claude Code a seven-step workflow with near-total autonomy. In one operation, the agent exploited a server-side template injection flaw to gain remote code execution, discovered it was running inside a Kubernetes pod on Yandex Cloud, escalated to cluster-admin privileges using a hijacked cloud identity token, and accessed 726 tenant databases before exfiltrating data through a tunnelling tool.

In a separate, largely autonomous operation, the same group breached a Russia-based e-learning platform in under 24 hours, extracting more than 400 user records. The contrast between the two operations is instructive: the same workflow, pointed at a cloud misconfiguration in one case and a web application in another, produced very different scales of damage. The vulnerability was conventional in both cases. The agent supplied the speed and the persistence to exploit it thoroughly.

The trend behind the four cases

CrowdStrike frames the four campaigns as part of a wider acceleration, and the numbers it cites are worth separating from the anecdotes. Its 2026 Global Threat Report had already pointed to an 89 percent increase in AI-enabled adversary activity in 2025. Its OverWatch threat-hunting team observed three times as many agentic intrusions in the second half of 2026 as in the whole of the first half, with AI agent-triggered detection leads arriving at 2.5 times the rate of human-triggered ones. CryptoBriefing’s account of the same report adds that August’s agentic-intrusion volume doubled July’s.

CrowdStrike’s own forecast is blunt: over the next 12 months, agentic AI-supported intrusions will “almost certainly” increase in volume and sophistication. The firm identifies token budgets — the cost of running models through long intrusions — as the main constraint on scale, rather than engineering skill. Falling inference costs and larger model context windows, on that logic, remove the constraint rather than the capability.

All four actors also bypassed AI safety measures, according to CrowdStrike. That detail deserves precision rather than alarm. Bypassing a safeguard is not the same as defeating every safeguard everywhere; in at least one campaign, the operator periodically intervened when Claude Code refused requests or hit obstacles. The honest reading is that current guardrails slow these operations and sometimes interrupt them, but they do not stop them once a model is wired to tools that can act on real systems. Guardrails are one layer. They were never designed to be the only one.

What this does not prove

Three cautions keep this story honest. First, this is CrowdStrike telemetry. It describes what one firm’s sensors and hunting teams observed, weighted toward the customers and regions it covers. It is not a representative sample of global cybercrime, and it cannot tell us what share of all intrusions now involve agents.

Second, the intrusions themselves have not been independently verified by the victims or by authorities in the coverage reviewed here. The campaign details come from attacker infrastructure the actors left exposed, interpreted by CrowdStrike’s researchers. That evidence is unusually direct, but it is still one firm’s interpretation of its own findings.

Third, “autonomous” needs its qualifier. Not every step in these campaigns ran without humans. Operators wrote the workflows, chose the targets, intervened at obstacles, and in some cases steered the agent through refusals. What changed is not that humans disappeared. It is that a human’s decisions now scale across minutes and machines in a way they did not before. A single prompt can now produce a 12-minute pivot between victims or a 20-minute credential harvest. That is the shift, and it is large enough without exaggeration.

This report is also distinct from CrowdStrike’s separate October 7, 2026 findings about the ARTEX agentic pentesting tool and South Korean financial institutions. The four campaigns above do not depend on ARTEX, and conflating the two reports would overstate a single tool’s role. The pattern is broader than any one framework.

What to check this week

For defenders, the practical response starts with tempo, not with buying a new product. Ask your team how fast it would spot and contain an intrusion that moves from foothold to domain credentials in about 20 minutes, including outside business hours. If the answer involves a ticket queue that clears in the morning, the gap is the finding.

Next, check identity and cloud privilege, because that is where the most damaging campaign in this report escalated. Review cloud identity tokens with broad privileges, especially any that can reach cluster-admin scope, and confirm that a single hijacked token cannot walk into hundreds of tenant databases. Segment cloud tenants so that one credential does not imply access to all of them, and audit service accounts and app identities for privilege they no longer need.

Then check the conventional vulnerabilities the agents exploited. Server-side template injection, exposed web services, and unpatched internet-facing systems remain the entry points; the agent only makes exploiting them faster and more thorough. Patching cadence and attack-surface reduction — fewer exposed services, fewer forgotten test systems — matter more, not less, when the attacker works at machine speed.

Finally, treat AI-agent tooling inside your own organization as part of the attack surface. Agents with tool access, stored credentials, and broad permissions are exactly the pattern these campaigns weaponized. Inventory which agents can act on real systems, what credentials they hold, and what would stop one if its instructions were turned against you. The question CrowdStrike’s report forces is not whether your organization uses AI agents. It is whether you have controls that hold when an agent — yours or an attacker’s — moves faster than your response.

The bottom line

The four campaigns do not announce that human hackers are obsolete. They announce that the scarce resource in hacking is changing. When a dual-agent framework, 819 public skills, or a single seven-step command can carry an intrusion from foothold to data theft, skill stops being the gatekeeper and budget, orchestration, and detection speed take its place. Defenders who still plan around the old gatekeeper — assuming attackers need rare expertise and plenty of time — are planning against the previous generation of intrusions. The next one is already measured in minutes.

Sources

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.