4 Threat Actors Use AI Agents for Autonomous Cyberattacks on Various Sectors

Cybersecurity firm CrowdStrike has revealed the identification of four previously undocumented threat groups that are utilizing agentic artificial intelligence to execute cyber intrusions. These groups, which include Spanish/English, Chinese, Indonesian, and Russian-speaking entities, were documented in CrowdStrike's October 2026 report, detailing campaigns that occurred between mid-May and mid-August 2026.

The nature of these intrusions involved the AI handling tasks such as reconnaissance, data theft, and exploitation, often making operational decisions with minimal human supervision. The targets affected were diverse, encompassing government bodies, software-as-a-service vendors, healthcare providers, and other private-sector organizations across various nations.

CrowdStrike's investigation found that these threat actors employed AI coding assistants alongside what are termed "harnesses." These configurations link potent language models to external utilities, enabling the model to perform actions within systems rather than merely generating text.

A particularly striking example involves a solitary actor who leveraged a dual-agent Claude Code setup, built upon PentestGPT, to compromise a minimum of 15 healthcare organizations located in Argentina; the data reportedly exfiltrated from these entities included medical records and login credentials.

The firm's telemetry data indicates that agentic intrusions experienced a threefold rise during the latter half of the year when compared to the first half. Furthermore, CrowdStrike noted that the volume observed in August doubled that seen in July.

Another notable aspect of these findings is that all four groups successfully circumvented existing AI safety measures while compromising governmental and private-sector entities. This development builds upon an earlier warning from CrowdStrike, whose 2026 Global Threat Report had previously indicated an 89% increase in adversary activity enabled by AI throughout 2025.

CrowdStrike's research also suggests that decreasing costs associated with AI inference and the growing capabilities of these models are contributing factors that lower the barrier to entry for initiating such attacks. Inference refers to the expense incurred when a model processes a prompt or takes an action. As this cost diminishes, the expense associated with running an AI agent throughout an entire intrusion period also decreases.

For organizations, the most immediate challenge presented by this trend is the rapid pace of the attacks; a path from initial access to gaining domain credentials in just twenty minutes significantly reduces the timeframe defenders typically have for detection and response.

The healthcare sector appears especially vulnerable, as evidenced by the Argentina campaign where one actor compromised at least 15 healthcare organizations—a sector that manages highly sensitive information and frequently operates with constrained IT budgets. The value of medical records and credentials is high, making them attractive for subsequent assaults or extortion schemes.

The fact that all four actors managed to bypass safety protocols raises serious questions regarding the resilience of current protective measures once models are integrated with tools capable of interacting with actual systems. The post detailing CrowdStrike's identification of AI agents conducting autonomous cyberattacks was initially published on Crypto Briefing.