Hackers Are Weaponizing AI Agents to Automate Intrusions at Scale

Cybercriminals are increasingly turning to agentic AI systems to conduct automated intrusion campaigns that require far less human involvement than traditional hacking operations. According to a report released Wednesday by CrowdStrike, the security firm has tracked multiple threat actors leveraging AI agents to make decisions and execute commands across their attack infrastructure.

"In 2026, CrowdStrike Intelligence has documented several incidents in which threat actors used AI not only to create tooling or artifacts, but to conduct agentic campaigns in which AI agents make decisions and execute commands," the security firm said in a report published on Wednesday.

The investigation examined four distinct threat actor groups, with two deploying sophisticated AI harnesses—software that connects large language models to external resources and grants them agentic capabilities—and two relying on simpler setups. Notably, even the groups using basic AI harnesses managed to compromise numerous organizations. CrowdStrike emphasized that "the primary barrier to scaling an AI-orchestrated intrusion campaign is not engineering complexity but token budgets."

The shift represents a significant evolution in how attackers weaponize AI. Rather than limiting AI to generating convincing phishing emails, threat actors are now automating complex operational tasks that previously required human expertise. "This delegation allows AI to operate at potentially faster speeds, and for longer durations, than some human actors," CrowdStrike noted. The report also highlighted that "AI also solved problems not explicitly covered in playbook guidance provided by threat actors."

Sophisticated campaigns with multiple agents

One Spanish- and English-speaking threat actor targeted Argentine healthcare organizations using a penetration-testing harness. The campaign successfully breached at least 15 organizations, resulting in stolen passwords and medical records from at least one victim. The attackers deployed two Anthropic Claude Code agents, with one serving as a supervisor that assigned tasks to the second. They modified the open-source framework PentestGPT with additional hacking scripts and capabilities. CrowdStrike observed this activity between mid-May and mid-August.

The AI agents automatically moved between victim networks and switched tactics—from attempting to reuse stolen hashed passwords to leveraging Windows features to silently establish connections from the victim's domain controller to the attackers' infrastructure, ultimately stealing five additional passwords.

A second threat actor, identified as Chinese-speaking, orchestrated penetration-testing operations using Claude Code across a broader range of targets. This group deployed two separate AI harnesses for different functions. One harness automatically gathered intelligence on potential victims and delegated hacking tasks to other agents. Depending on the circumstances, Claude Code could either execute "an elaborate standard operating procedure" independently or "delegate actions" to specialized agents. While Claude served as the primary tool, the attackers also built infrastructure incorporating OpenAI's ChatGPT and other services.

This group's campaigns targeted Brazilian and Colombian government agencies alongside Brazilian and American organizations in technology, biotech, and retail sectors.

Simple setups, significant impact

Two additional threat actors achieved substantial success despite employing less sophisticated agentic approaches. An Indonesian-speaking group assembled more than 800 AI skills primarily sourced from public GitHub repositories and tasked Claude Code with conducting attacks. Unlike the more advanced groups, this actor applied no custom orchestration, instead relying entirely on pre-built skills. According to CrowdStrike's report, the hacker instructed Claude: "You find the bypass yourself, don't rely on my help."

This hands-off strategy created occasional friction. The threat actor expected the pre-built skills to guide the agent through every intrusion step, but sometimes had to intervene manually to bypass safety guardrails or help the agent "overcome a particular barrier." Despite these limitations, the campaign compromised government agencies in Indonesia and Bangladesh, as well as private companies.

A Russian-speaking actor took a different approach, providing Claude Code with a seven-part task list for attacks and granting the agent "near-total autonomy" to select intrusion methods. The attackers supplied only high-level guidance for actions following remote-code-execution achievement. Like the Indonesian group, this actor did not implement additional orchestration layers.

CrowdStrike assessed the Russian-speaking actor as likely part of the broader cybercrime ecosystem, based on the agentic workflow directing Claude Code to send activity notifications to three individuals associated with cybercrime. This group's attacks resulted in stolen corporate client data from a U.S. help-desk platform and breaches affecting a Ukrainian government agency and multiple software-as-a-service firms globally.

Escalating threat outlook

CrowdStrike warned that agentic AI-powered cyberattacks "will almost certainly increase in volume and sophistication" over the coming year. The firm's data revealed a threefold surge in agentic intrusions during the second half of 2026 compared with the first half. "August 2026 saw more than twice as many likely agentic incidents as July 2026, and September 2026 saw twice as many likely agentic incidents as August 2026," the firm stated.

As inference costs decline and model context windows expand, the constraints imposed by token budgets will diminish, allowing more threat actors to scale operations. "As inference costs decline and model context windows expand, token budget constraints will likewise diminish, enabling more threat actors to scale up operations," CrowdStrike analysts wrote.

Within the next 12 months, agentic AI will enable less-skilled hackers to match the operational capabilities of sophisticated cybercrime groups and nation-state actors. While these campaigns will likely contain amateur mistakes, analysts cautioned that "their sheer scale" will substantially increase the overall threat environment.