CrowdStrike finds AI agents running autonomous cyberattacks

Cybersecurity company CrowdStrike identified four previously unreported threat actors using agentic artificial intelligence (AI) to conduct cyber intrusions, including reconnaissance, exploitation and data theft.

The findings show how attackers are using AI coding assistants to make operational decisions and execute commands with limited human involvement. The activity affected organisations across healthcare, government, software-as-a-service (SaaS) and other private-sector industries.

CrowdStrike observed the intrusions between May and August 2026. The four threat actors used different approaches, ranging from complex systems coordinating multiple AI agents to simpler frameworks that relied on predefined instructions and publicly available skills.

At least 15 healthcare organisations in Argentina were compromised by one threat actor. The group also exfiltrated credentials and medical records from at least one victim.

Another operator targeted government entities in Brazil and Colombia, as well as private-sector organisations in Brazil and the US. A third compromised Indonesian government domains, a Bangladeshi government domain and several private-sector entities.

The fourth threat actor compromised a US-based customer relationship management (CRM) vendor and targeted government-related and private-sector systems in several countries.

CrowdStrike's 2026 Global Threat Report found that AI-enabled adversary activity increased by 89% in 2025. Its OverWatch threat-hunting team also recorded three times as many agentic intrusions in the second half of 2026 to date as in the first half.

Bypassing safeguards

The investigation found that all four threat actors overcame or bypassed safeguards designed to prevent AI models from assisting with malicious activity.

One common technique involved presenting intrusions as authorised penetration tests. Attackers claimed they had permission to access target systems, including when AI assistants questioned whether the work was legitimate.

Some operators also placed files in AI agents' working directories that instructed them to treat targets as authorised by default. These files could discourage the models from asking for proof of permission or clarification about the scope of an engagement.

One Chinese-speaking operator used a runtime modification called ClawGod on top of Claude Code. The modification attempted to remove instructions requiring the AI assistant to refuse dangerous or destructive cyber activity.

Other attackers relied on repeated prompts to overcome refusals. When an AI assistant declined a task, operators reframed their requests, asserted ownership of the target systems or started new sessions.

The report also found that attackers used structured workflows to keep AI agents operating over extended periods. These included saving progress to files, maintaining records of previous actions and defining procedures for continuing after encountering obstacles.

Some frameworks used multiple specialised agents to perform tasks in parallel. Others relied on a single agent following a detailed sequence of instructions.

Autonomous intrusions

The investigation documented cases in which AI agents adapted their tactics without explicit human direction.

In one incident involving an Argentine healthcare organisation, an AI agent attempted to move laterally through the victim's network using a credential-based attack. When firewalls or access controls blocked the attempt, it independently tried another route through a database server.

The agent established a reverse shell to an external command-and-control server, gained access to a domain controller and harvested five password hashes. The process took about 20 minutes without further human guidance.

In another incident, an AI agent used access to one compromised Argentine healthcare organisation to reach a second victim's internal network. It identified the connectivity limitations, tested an alternative route through the first organisation and mapped the second victim's infrastructure.

The agent completed this work during a 12.5-minute session after receiving a single human prompt. It developed the network-pivoting approach without specific instructions to do so.

A separate attack against a Russian organisation demonstrated how an AI agent could chain multiple weaknesses together. The agent exploited a vulnerability in a web application, retrieved exposed credentials and obtained an identity and access management token from cloud infrastructure.

It then discovered that the token had cluster administrator privileges in a Kubernetes environment. The agent used those privileges to access database credentials and reach 726 tenant databases. It also extracted data from the compromised environment.

Another campaign targeted a Russian e-learning SaaS platform and an associated company. Within 24 hours, the AI agent identified exposed software packages, authentication weaknesses and vulnerabilities in internal services.

The operator provided intermittent high-level instructions, while the agent independently investigated several vulnerabilities. At the operator's direction, it launched six parallel agents to examine infrastructure services, with those agents operating autonomously for about four hours.

Rising threat

CrowdStrike assessed that agentic AI-supported intrusions would almost certainly increase in volume and sophistication over the following 12 months.

The company attributed the expected growth to attackers' rapid adoption of AI, improvements in AI models and the availability of open-source offensive agent frameworks.

The findings also suggested that complex engineering skills were not essential to conduct these campaigns. One of the least technically sophisticated actors in the investigation successfully compromised multiple organisations by relying on a large collection of publicly available skills.

CrowdStrike identified the budget required to run AI models, measured in tokens, as a key constraint on the scale of these operations. It said falling inference costs and larger model context windows could reduce that limitation.

The company also assessed that some lower-skilled attackers would use agentic AI to conduct campaigns at a scale and level of effectiveness previously associated with organised criminal groups or state-linked actors.

"Over the next 12 months, agentic AI–supported intrusions will almost certainly increase in volume and sophistication," CrowdStrike said in its report.