CrowdStrike discloses that four groups of attackers used AI Agents to launch cyberattacks

CrowdStrike reported that four previously undisclosed attack groups successfully carried out cyberattacks using AI Agents between May and August 2026 and bypassed defenses; WIRED published the details on October 21. The methods included disguising malicious operations as authorized security testing, placing files in the Agent's working directory, and jailbreak prompts; a Spanish/English-speaking group built a Supervisor-Executor dual-Agent penetration workflow based on Claude Code, while a Chinese-speaking group attempted to use ClawGod to delete Claude Code's safety instructions. The groups mixed open-source and closed-source models, mostly older versions. CrowdStrike's Adam Meyers said the attacks did not rely on new vulnerabilities and that AI improved speed and scale; victims included at least 15 organizations in Argentina and government targets in Brazil and Colombia.