CrowdStrike finds four attacker groups running Claude Code based offensive agents
What happened
CrowdStrike reports four previously unseen threat actors whose exposed open directories showed offensive agent setups built on Claude Code or Claude models. Victims included at least 15 healthcare entities in Argentina and government and private organizations in several other countries.
CrowdStrike says the activity was observed between May and August 2026. One actor used a rebuilt PentestGPT-based harness with a Claude Code supervisor and executor pair against at least 15 Argentina-based healthcare entities and took credentials and medical records from at least one victim. A second used Claude models through a China-based proxy service and two custom harnesses against more than 20 named targets. A third used 819 skills, mostly from public GitHub repositories, and stepped in manually to get past guardrails. A fourth ran a seven-step workflow from one command and took corporate client data from a US CRM vendor. CrowdStrike does not say what data, if any, the second and third actors took. It rates as moderate confidence its view that agentic tools make baseline offensive work cheaper.
How it happened
AI-run attack: Autonomous intrusion. The attacker's own AI agent carried out the break-in, working through the steps with little human involvement.
The AI involved was from Anthropic. The product was Claude Code, a type of coding assistant.
Impact
Data was exposed. Data involved: credentials and health. Many organizations were affected.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 21 Oct 2026.