CrowdStrike Uncovers New Agentic AI Campaigns CrowdStrike's Counter Adversary Operations team documented four previously unreported threat actors running agentic AI attack campaigns between May and August 2026, each of which exposed its offensive agent framework through open directories. The actors built autonomous penetration-testing harnesses around Anthropic's Claude Code — including a dual-agent "Supervisor" and "Executor" design derived from the open-source PentestGPT project — and one Spanish/English-speaking operator compromised at least 15 Argentina-based healthcare entities, exfiltrating credentials and medical records from at least one victim. A Chinese-speaking actor with 20+ named global targets compromised government entities of two countries, while an Indonesian-speaking actor used 819 skills, mostly from public GitHub repositories, to compromise several Indonesian government domains. A new report from the CrowdStrike Counter Adversary Operations team https://www.crowdstrike.com/en-us/resources/reports/agentic-ai-attack-campaigns/ details research into four previously unreported threat actors, each of whom left their offensive agent frameworks exposed via open directories. In doing so, they shared detailed insight into their use of AI agents and revealed how adversaries are quickly becoming more proficient in AI. AI is changing the speed and scale of cyber operations. Counter Adversary Operations, which brings together the CrowdStrike Intelligence and CrowdStrike OverWatch teams, is closely watching. Between May and August 2026, CrowdStrike Intelligence documented several incidents in which threat actors used AI not only to create tooling or artifacts, but to conduct agentic campaigns in which AI agents make decisions and execute commands. About the Adversaries Below is a high-level overview of the threat actors behind these campaigns: Threat Actor 1 A Spanish/English-speaking operator that has compromised at least 15 Argentina-based healthcare entities and exfiltrated credentials and medical records from at least one victim. The threat actor ran a purpose-built autonomous penetration testing pentesting harness against Argentine healthcare organizations. They implemented a dual-agent architecture in which a “Supervisor” Claude Code agent selects the next task from a state machine i.e., a predefined workflow of attack stages and an “Executor” agent performs the task. This framework is derived from the open-source PentestGPT project, but the threat actor has rebuilt it with additional MCP servers, Python-based exploitation scripts, and skills. Threat Actor 2 A Chinese-speaking operator with 20+ named global targets. They compromised government entities of two countries and targeted private sector entities in Brazil and the U.S., including entities in biotech, healthcare, food and beverage, retail, technology, and travel. This threat actor primarily accessed Claude models via a China-based AI proxy service aka a “transfer station” , and they built two pentesting harnesses that grant Claude Code varying levels of autonomy. One harness consists of a Python-based project that deterministically conducts reconnaissance and then asks an AI provider to choose among a preestablished set of possible actions that are deterministically routed to the appropriate agent. A different harness provides more agentic flexibility, allowing Claude Code to operate either as a single agent pursuing a target according to an elaborate standard operating procedure, or delegating actions to multiple specialist agents in parallel. Threat Actor 3 The least sophisticated of the four in this report is an Indonesian-speaking actor that uses 819 skills overwhelmingly sourced from public GitHub repositories, primarily claude-red