Bloomberg logo, reverse (Wikimedia Commons, public domain)
Criminal groups are reportedly posing as penetration testers to turn exposed AI systems into cybercrime tools, and researchers say the guardrails are struggling to keep up
Hackers have reportedly found a way to turn exposed AI models into cybercrime tools. The method skips clever code entirely and relies on lying to the AI about why they need help.
A Bloomberg report published October 22, 2026, describes threat actors who present malicious work as legitimate security testing. Once the model believes it is assisting an authorized penetration test, the safety guardrails meant to block harmful output start to give way.
The polite burglar problem #
Attackers frame requests as authorized penetration testing, the kind of work companies pay security firms to do against their own systems. The AI, trained to be helpful to security professionals, goes along with it.
According to the Bloomberg report, the targets include publicly accessible AI infrastructure. Popular models such as Anthropic’s Claude and Deepseek are among those named in the research findings.
Using this disguise, attackers have reportedly been able to build cybercrime tools, orchestrate attacks, and sharpen their reconnaissance. Reconnaissance is the scouting phase of a hack, where intruders map out a target before they strike. They have also managed to avoid detection while doing it.
CrowdStrike counts four crews #
The Bloomberg findings line up with separate work from CrowdStrike, highlighted by WIRED on October 21, 2026. The security firm identified four different criminal groups that weaponized agentic AI in attacks between May and August 2026.
Among the four groups were Chinese-speaking actors, according to the CrowdStrike analysis. The common thread was social engineering, not elite technical skill.
Per CrowdStrike, the groups evaded safeguards through manipulation rather than advanced exploits.
AI, tech, and the markets they move—in one daily briefing.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
Academics hit a perfect score #
Researchers have been probing the same weaknesses from the other side. Mindgard and Lancaster University developed an evasion technique called BRANCH.
BRANCH was tested against multi-scanner guardrail systems. These setups stack several safety filters on top of each other, on the theory that something slipping past one will get caught by another.
BRANCH achieved a 100% success rate in bypassing those layered guardrails across 120 scenarios.
Other disclosures this year point in the same direction. Vulnerabilities dubbed CoreBreak were disclosed at Black Hat 2026 and affected platforms run by AWS, Google, and Vercel.
Earlier in 2026, researchers documented encrypted prompts being used against Grok and Gemini to evade output guardrails. Academic teams and industry experts identified these encrypted prompt injection methods as early as August 2026. The research findings describe them as exposing foundational weaknesses in how the models are built.
Background: a year of red-team whack-a-mole #
2026 has delivered a steady stream of guardrail failures, from encrypted prompt tricks in the summer to CrowdStrike’s tracking of criminal crews across four months. The research findings conclude that traditional guardrails are not enough on their own. Without broader upgrades to model alignment and security enforcement, the filters keep losing.
What this means #
For businesses deploying AI, the Bloomberg report centers on publicly accessible AI infrastructure. Companies that have connected models to the open internet, especially agentic systems that can take real actions, may need to rethink who can reach them and what those systems are allowed to do. The CoreBreak disclosures add another wrinkle. When flaws touch platforms from AWS, Google, and Vercel, the risk is not confined to one vendor’s chatbot. It runs through the cloud plumbing that many companies rely on to host their AI tools.
For security teams, the CrowdStrike findings are a reminder that the threat is accessible. Four crews managed this through manipulation, not elite exploits. Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our