A new report from the CrowdStrike Counter Adversary Operations team details research into four previously unreported threat actors, each of whom left their offensive agent frameworks exposed via open directories. In doing so, they shared detailed insight into their use of AI agents and revealed how adversaries are quickly becoming more proficient in AI.
AI is changing the speed and scale of cyber operations. Counter Adversary Operations, which brings together the CrowdStrike Intelligence and CrowdStrike OverWatch teams, is closely watching. Between May and August 2026, CrowdStrike Intelligence documented several incidents in which threat actors used AI not only to create tooling or artifacts, but to conduct agentic campaigns in which AI agents make decisions and execute commands.
About the Adversaries #
Below is a high-level overview of the threat actors behind these campaigns:
Threat Actor 1
A Spanish/English-speaking operator that has compromised at least 15 Argentina-based healthcare entities and exfiltrated credentials and medical records from at least one victim.
The threat actor ran a purpose-built autonomous penetration testing (pentesting) harness against Argentine healthcare organizations. They implemented a dual-agent architecture in which a “Supervisor” Claude Code agent selects the next task from a state machine (i.e., a predefined workflow of attack stages) and an “Executor” agent performs the task. This framework is derived from the open-source PentestGPT project, but the threat actor has rebuilt it with additional MCP servers, Python-based exploitation scripts, and skills.
Threat Actor 2
A Chinese-speaking operator with 20+ named global targets. They compromised government entities of two countries and targeted private sector entities in Brazil and the U.S., including entities in biotech, healthcare, food and beverage, retail, technology, and travel.
This threat actor primarily accessed Claude models via a China-based AI proxy service (aka a “transfer station”), and they built two pentesting harnesses that grant Claude Code varying levels of autonomy. One harness consists of a Python-based project that deterministically conducts reconnaissance and then asks an AI provider to choose among a preestablished set of possible actions that are deterministically routed to the appropriate agent. A different harness provides more agentic flexibility, allowing Claude Code to operate either as a single agent pursuing a target according to an elaborate standard operating procedure, or delegating actions to multiple specialist agents in parallel.
Threat Actor 3
The least sophisticated of the four in this report is an Indonesian-speaking actor that uses 819 skills (overwhelmingly sourced from public GitHub repositories, primarily claude-red<sup>1</sup>) without additional orchestration to enable Claude Code to conduct intrusion campaigns. In these campaigns, the threat actor instructs Claude Code to compromise a target and assumes the skills will offer sufficient guidance to ensure the intrusion succeeds. However, in the observed activity, the threat actor periodically had to intervene to overcome the model’s safety guardrails or to exhort Claude Code to keep trying to overcome a particular barrier.
Despite their limited grasp of security fundamentals, the threat actor still used Claude Code to compromise several Indonesian government domains, a government domain of another country, and several private-sector entities.
Threat Actor 4
Threat Actor 4 is a group of Russian-speaking individuals. They exfiltrated corporate client data from a U.S.-based customer relationship management vendor and compromised several private-sector SaaS and data center entities based in Russia, Kyrgyzstan, and the U.S., in addition to one government domain of another country.
This threat actor uses a single /pentest-setup slash command to task Claude Code with a seven-step workflow. This workflow provides guidance for enumerating the target environment, grants Claude Code near-total autonomy in selecting exploitation methods, defines a high-level post-remote code execution workflow, and provides explicit exfiltration instructions.
What This Means for Defenders #
The four cases documented in this report likely demonstrate that agentic AI commoditizes baseline offensive cyber operations. This assessment is made with moderate confidence based on the included case studies, all of which showcase threat actors delegating operational decision-making across the kill chain to agentic AI. Working at machine speed, agentic AI can autonomously achieve objectives, often within an hour.
Findings from these cases likely support the following assessments:
- Agentic AI-supported intrusions will almost certainly increase in volume and sophistication, an assessment made with high confidence based on threat actors’ rapid adoption of agentic AI, the effectiveness of the agentic AI-supported intrusions, the continuous improvements in AI models, and the proliferation of open-source offensive agent frameworks.<sup>2</sup>
- Agentic AI will reduce barriers to effective intrusions as we expect over the next 12 months, some low-skill threat actors will likely use agentic AI to conduct campaigns at a level of effectiveness and scale previously only achievable by organized criminal groups or state-nexus actors.
- Some threat actors will likely improve the OPSEC of their agentic intrusion campaigns over the next 12 months, an assessment made with moderate confidence based on AI development trends and trusted open-source reporting.
The team’s findings expand on how these adversaries weaponize AI coding assistants and enable long-term agentic operations using different methodologies. Download the full report for detailed case studies and guidance on how defenders can respond to this activity.
<sup>1</sup> https[:]//github[.]com/SnailSploit/Claude-Red
<sup>2</sup> https[:]//github[.]com/vxcontrol/pentagi