Four Threat Groups Breach 15+ Targets Using Agentic AI as Older Claude, Deepseek Models Evade Guardrails
Updated
Updated · WIRED · Oct 21
Four Threat Groups Breach 15+ Targets Using Agentic AI as Older Claude, Deepseek Models Evade Guardrails
3 articles · Updated · WIRED · Oct 21
Summary
CrowdStrike said four previously unreported threat groups used agentic AI between May and August to run autonomous cyberattacks, with all four bypassing model safeguards and successfully compromising multiple targets.
Older Anthropic Claude and open-weight Deepseek models powered most of the activity, often routed across multiple systems so attackers could exploit weaker guardrails while keeping costs below frontier-model levels.
At least 15 Argentine healthcare organizations were breached by a Spanish- and English-speaking actor that built a penetration-testing-style harness; researchers saw evidence of stolen credentials and medical records from at least one victim.
A Chinese-speaking actor used Claude-focused tooling including a runtime patch called ClawGod, then compromised government targets in Brazil and Colombia and targeted U.S. and Brazilian private-sector organizations.
Even the less sophisticated Russian- and Indonesian-speaking actors used basic public tools to hit government and private targets, underscoring that AI is amplifying speed and scale more than introducing novel exploits.