Organizations are facing intrusion campaigns in which AI agents can choose actions and execute commands at machine speed. CrowdStrike documented four previously unreported actors whose exposed frameworks showed different levels of automation and autonomy. Reported victims included healthcare, government, software-as-a-service and data center organizations. The researchers assessed with moderate confidence that agentic AI is making baseline offensive operations easier to conduct.
What Happened
CrowdStrike reported four previously undisclosed threat actors whose offensive AI frameworks were exposed through open directories. The material provided visibility into how different operators were using coding assistants and agent workflows to make decisions and execute commands during intrusion campaigns. The observed activity occurred between May and August 2026.
One Spanish- and English-speaking operator used a two-agent framework against healthcare organizations in Argentina. A supervisor agent selected the next task from a defined sequence of attack stages, while an executor performed the work. The operator compromised at least 15 healthcare entities and exfiltrated credentials and medical records from at least one victim.
A Chinese-speaking operator built two frameworks that gave Claude Code different levels of autonomy. One used deterministic reconnaissance and asked an AI provider to select from established actions. The other allowed a single agent to follow an extensive procedure or delegate work to specialist agents in parallel. The operator had more than 20 named global targets and compromised government entities in two countries.
An Indonesian-speaking actor relied heavily on 819 publicly sourced skills and sometimes had to intervene when the model encountered safety controls or operational barriers. Despite limited security expertise, the actor compromised several government domains and private-sector entities. A Russian-speaking group used one command to launch a seven-step workflow that gave Claude Code broad freedom to choose exploitation methods and included post-access and data-exfiltration instructions.
CrowdStrike assessed with moderate confidence that these cases show agentic AI commoditizing baseline offensive cyber operations. The researchers said such agents can work at machine speed and may achieve objectives within an hour.
Why It Matters
The research moves the AI security discussion beyond content generation. These operators were not only asking models to write scripts or explain techniques. They were delegating parts of operational decision-making, including choosing actions, coordinating specialist roles and continuing through a defined intrusion workflow.
That can reduce the amount of expertise or constant attention required from an attacker. The least sophisticated actor still achieved compromises while relying on publicly available skills and periodic human intervention. More structured operators used supervisors, state machines and parallel agents to create repeatable campaigns.
For defenders, the main consequence is compressed response time. Existing controls may still detect malicious logins, commands, data access or exfiltration, but an automated operator may move between those stages faster than a human-led investigation and approval process. The affected sectors in the report included healthcare, government, biotechnology, technology, retail, travel, software-as-a-service and data center organizations.
What to Watch
The four exposed frameworks may not represent every way attackers are using agentic AI. Defenders should watch for campaigns that show fast transitions between reconnaissance, exploitation, credential access and data collection, especially when the activity uses legitimate developer or administration tools.
The level of autonomy will vary. Some actors may keep deterministic controls around an AI model, while others may let agents delegate work or select techniques more freely. Human intervention may still appear when safety controls or technical barriers stop progress. Future reporting may clarify how reliably these systems operate and whether the observed speed translates into broader success across more complex environments.
What Defenders Should Do
Detection: focus on observable behavior rather than trying to identify whether AI produced a command. Monitor abnormal authentication, unusual tool execution, rapid sequences of discovery commands, access to sensitive data and unexpected outbound transfers. Correlating these stages quickly matters more when an automated workflow can continue without waiting for a human operator.
Identity and access: reduce unnecessary privileges and protect credentials that connect source repositories, cloud platforms, administration systems and production environments. The reported actors targeted organizations where compromised identities and tools could support multiple stages of an intrusion.
Response: define which high-confidence signals can trigger immediate containment and who can authorize rapid action. If suspicious activity is moving across several systems quickly, waiting for a complete explanation of the attacker’s tooling may give the campaign more time to progress.
AI governance: organizations deploying their own coding agents should limit scope, preserve monitoring and separate agent permissions from sensitive production access. The same automation that improves legitimate work can magnify the consequences of an overprivileged identity or poorly constrained workflow.
The Larger Lesson
Agentic AI does not remove the need for attacker intent, access or infrastructure, but it can package knowledge and decision steps into reusable workflows. That may allow less capable operators to attempt more complex activity and help stronger operators run tasks in parallel.
The durable defensive lesson is to compete on control speed and visibility. Teams do not need to prove that an AI agent is behind every action. They need to recognize harmful behavior, contain it quickly and ensure that identities and automation cannot move freely across the environment.