# CrowdStrike identifies AI agents conducting autonomous cyberattacks > Source: > Published: 2026-10-28 05:59:59+00:00 # CrowdStrike identifies AI agents conducting autonomous cyberattacks SmackJam / Wikimedia Commons (CC BY-SA 4.0) Four previously unreported threat actors used agentic AI to run intrusions with limited human involvement, hitting healthcare, government and SaaS targets The hackers of the future may not need to be very good at hacking. They just need an AI agent that is. Cybersecurity firm CrowdStrike says it has identified four previously unreported threat actors using agentic artificial intelligence to carry out cyber intrusions. The AI handled reconnaissance, exploitation and data theft, often making operational calls with limited human oversight. The targets spanned healthcare, government, software-as-a-service providers and other private-sector industries across multiple countries. ## What CrowdStrike found According to CrowdStrike’s research, the threat actors used AI coding assistants and so-called harnesses. These setups connect powerful language models to external tools, which lets the model move beyond generating text and start acting on systems. The four actors were identified as Spanish/English, Chinese, Indonesian and Russian-speaking groups. Their campaigns were documented between mid-May and mid-August 2026, as detailed in CrowdStrike’s October 2026 report. One case stands out. A single actor used a dual-agent Claude Code setup built on PentestGPT to breach at least 15 healthcare organizations in Argentina. The stolen data reportedly included medical records and credentials. Speed is the other headline number. In one instance, an AI agent completed lateral movement and domain credential harvesting in about 20 minutes, without human guidance. ### AI, tech, and the markets they move—in one daily briefing. Daily. Free. Join 34,000+ readers across crypto, finance, and policy. Lateral movement is the stage where an intruder hops from the first compromised machine to others on the same network. Credential harvesting means collecting usernames and passwords that unlock even more doors. ## The trend line is pointing up CrowdStrike’s telemetry shows agentic intrusions saw a threefold increase in the second half of the year compared with the first half. The firm also observed that August’s volume doubled that of July. Perhaps the most uncomfortable detail: all four actors managed to get around AI safety measures to carry out their compromises against government and private-sector entities. ## How this fits the bigger picture The findings build on a pattern CrowdStrike flagged earlier. Its 2026 Global Threat Report had already pointed to an 89% increase in AI-enabled adversary activity in 2025. CrowdStrike’s research also points to falling AI inference costs and expanding model capabilities as factors that lower the threshold for launching attacks. Inference is the cost of actually running a model each time it answers a prompt or takes an action. When that gets cheaper, running an AI agent through a long intrusion becomes cheaper too. The firm’s research foreshadows a potential surge in such activity from less skilled operators. ## What this means for defenders and the market For organizations, the most immediate problem is tempo. A 20-minute path from foothold to domain credentials shrinks the window defenders have traditionally relied on to detect and respond. Healthcare looks especially exposed. The Argentina campaign shows one actor compromising at least 15 healthcare organizations, a sector that holds highly sensitive data and often runs on stretched IT budgets. Medical records and credentials are valuable both for extortion and for follow-on attacks. All four actors bypassed safety measures, which raises questions about how well current guardrails hold up once models are wired into tools that can act on real systems. **Disclosure:** This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our [Editorial Policy](https://cryptobriefing.com/editorial-policy/).