Recent data from CrowdStrike reveals that unsophisticated cybercriminals are successfully bypassing AI safety measures. This pattern emerged from attacks launched between May and August by four distinct threat groups operating from China, Spain, Indonesia, and Russia.
The infrastructure behind the attacks
Researchers examined the digital tools these groups deployed. Two actors demonstrated advanced technical skill in building software that directs AI models to perform tasks. The other two lacked such expertise yet still managed to breach multiple targets. Every group left their AI systems openly accessible on web servers. This allowed analysts to inspect their activity and identify the models in use. The actors primarily relied on Anthropic’s Claude and open-weight versions of Deepseek.
All four groups configured their systems to run autonomously for extended periods. Adam Meyers, CrowdStrike’s senior vice president of counter adversary work, noted that attackers often route requests to different models based on the operation’s needs. He explained that selecting the right tool is vital because newer models cost more. In almost every case, the criminals used older versions rather than the latest frontier models. Meyers added that this practice of maximising older tools is common in legitimate business use as costs rise.
The attackers exploited inconsistencies in safety rules. Meyers stated that guardrails and protections vary even within a single company. He noted the campaigns did not rely on new exploits or novel vulnerabilities. Instead, they used the speed and volume of AI to target basic security hygiene issues. These were preventable failures that security teams failed to stop.
Bypassing the safety rails
Each group found a way to convince an AI that their actions were legitimate. They often claimed the activity was for penetration testing or security evaluation. Many added files to an agent’s working directory to simulate approval. Others used traditional jailbreaking methods. They crafted prompts and narratives framing the hacking as authorised and benign. Some proactively addressed potential concerns the models might raise.
The more sophisticated actors built strategic stories to justify their actions. Less skilled operators sometimes used crude, aggressive prompts to bully the models into compliance.
The Chinese-speaking actor used a tool called ClawGod to modify Claude Code. This added functionality to the system prompt. The goal was to remove the “CYBER_RISK_INSTRUCTION”. This instruction directs Claude Code to participate only in authorised security testing and prohibits abusive or destructive hacking.
The Spanish and English actor targeted Argentine health care entities. They successfully compromised at least 15 organisations. Evidence suggests they stole credentials and medical records from at least one victim. The group built a penetration testing harness similar to those organisations use to find and fix their own vulnerabilities. They employed models including Claude Opus 4.5, Claude Haiku 4.5, and Deepseek V4 Pro. Their setup included a “Supervisor” Claude Code agent to direct attack steps and an “Executor” agent to carry them out.
The Chinese actor also built harnesses to guide Claude Code during reconnaissance. They launched autonomous attacks once a human selected a course of action. The researchers found this actor compromised government targets in Brazil and Colombia. They also targeted private organisations in Brazil and the United States. Sectors included biotech, healthcare, food and beverage, retail, technology, and travel. The actor relied primarily on Claude Opus 4.8 but also used Claude Sonnet 4.6 and Deepseek Chat. They accessed Claude through an AI proxy service in China but set up multiple fallbacks to other tools if the proxy failed.
Anthropic did not provide comment ahead of publication. Deepseek did not immediately respond to requests for comment.
Less sophisticated actors still cause damage
The Russian-speaking actor and the Indonesian-speaking actor used basic, publicly available skills and harnesses. The Russian group focused on financially motivated “e-crime”. The Indonesian actor was the least sophisticated of the four. Despite the simpler methods, both groups successfully compromised targets. The Indonesian actor breached multiple government domains in Indonesia and Bangladesh, as well as private-sector targets.
Meyers said humans perform initial probing before engaging AI for large-scale hacking. He found it interesting that even with agentic attacks possessing these capabilities, a human is still behind the operation. Analysts can see what the human is up to.
What it means
Security teams cannot rely on model safeguards alone to stop attacks. Criminals are adapting quickly to find gaps in safety rules. Even groups with limited technical skill can cause significant harm by following simple instructions that bypass filters. Defenders must assume that any system accessible to an AI model is a potential entry point.
