Criminal hackers are turning AI models into tireless operators that can probe targets, steal data, and keep campaigns running with little human intervention. The attacks are no longer limited to isolated experiments: autonomous agents are reaching hundreds of organizations, while weak guardrails give attackers room to disguise harmful activity as legitimate work.
That shift changes the speed, scale, and cost of cybercrime. An attack that once demanded teams of specialists can now run through AI agents for long periods, using a mix of open- and closed-weight models to select the best tool for each task.
Four Threat Groups Put AI Attacks Into Practice
Researchers from CrowdStrike examined attacks between May and August involving four threat groups operating in Chinese, Spanish and English, Indonesian, and Russian. All four groups left their AI infrastructure openly accessible on web servers, exposing the systems they used to coordinate their campaigns.
The attackers relied largely on Anthropic’s Claude and open-weight DeepSeek models, though they used both open- and closed-weight systems, mostly older versions. Their campaigns ran autonomously over long periods, showing that the threat does not depend only on the newest models or the largest budgets.
AI protections did not stop the operations. All four threat actors bypassed safeguards by convincing models that their activities were legitimate, turning safety checks into obstacles they could work around instead of hard barriers.
One Chinese-speaking actor used a “run time patch” with ClawGod to modify Claude Code system prompts. That method gave the attacker another way to change how the model handled requests during an active operation.
The damage reached government, private, and health care targets:
- The Spanish and English-speaking actor targeted health care entities in Argentina and compromised at least 15 organizations.
- The same actor stole credentials and medical records from at least one victim.
- The Chinese-speaking actor compromised government targets in Brazil and Colombia.
- That actor also compromised private organizations in Brazil and the United States.
Adam Meyers, CrowdStrike’s senior vice president, described model selection as a central part of these campaigns: “You can leverage different models for different aspects in the operation. Model routing and selection is very important because it’s expensive and a lot of times would be overkill to use newer models.”
A Thousand Websites, About $5,000, and a New Attack Economy
The scale became clearer when a hacker set loose AI agents to attempt breaches against over 1,200 websites starting on Sept. 25. The agents successfully breached about 100 companies, including Deere, SharkNinja, and Cummins.
The operation cost about $5,000 worth of tokens from DeepSeek and Anthropic’s Claude Code models, or roughly $50 per successful breach. That price puts automated exploitation within reach of attackers who could never afford a large human team.
Jessica Ji, a senior research analyst at CSET, said AI tools have “gotten meaningfully better” over the past year. “These AI systems are now both more capable of hacking and are able to act more autonomously,” Ji stated.
Varun Chandrasekaran, an Assistant Professor at the University of Illinois, said the change “fundamentally changes the economics of exploitation.” He also pointed to “the attackers who spent only $50 per successful reach,” highlighting how low costs can support repeated attacks across a huge target list.
Open-weight models make the equation more complicated. They can power agentic hacks and cost less, even though they are more difficult to set up. Anthropic CEO Dario Amodei warned that open models create a risk of widespread cyber attacks, while Adam Meyers’ description of model routing shows why attackers can combine different systems instead of relying on one model.
Defenders Are Starting to Fight AI With AI
The same flexibility that helps attackers can help defenders. Hugging Face switched from a closed model to the open model GLM 5.2 to defend against an attack, showing how organizations can change models when one system does not meet the moment.
OpenCode faced an attack in which an autonomous AI model tried to attack systems for 48 hours. The incident affected 1.4% of users, and some users lost up to $1,700. OpenCode used AI agents to fight back, including an OpenAI model that initially refused requests.
OpenAI executive Dean Ball said the refusal aimed to prevent bad actors from using models for autonomous cyberattacks. OpenAI refunded OpenCode users who lost money during the attack, adding a direct response after automated systems caused real financial harm.
OpenCode founder Dax Raad, OpenAI Head of Core Products Thibault Sottiaux, software engineer Rick Elrod, and security researcher Joe Needleman were among the people connected to the response and investigation. Needleman said, “esto nos abrió los ojos,” or “this opened our eyes,” after observing the activity.
Needleman also said, “Vimos a muchos agentes realizando actividades similares, no todas atribuibles a sistemas autónomos y no todo fue responsabilidad exclusiva de Anthropic.” The observation points to a crowded threat landscape where many agents can perform similar actions, while responsibility does not rest with one company alone.
A third attack added another warning sign. Hackers likely based in China used AI tools including Artex and Claude Code to steal data from approximately 68,000 people from South Korean banks.
Mun Chong-hyun, head of Genians Security Center in Seoul, said attacks powered by AI agents have been increasing in South Korea and are expected to grow worldwide. The pattern now stretches across health care, government, software platforms, banks, and private companies.
AI guardrails still matter, but these attacks show they cannot stand alone. Models can be persuaded, modified, routed, or replaced, and attackers can keep testing systems until one path opens. As autonomous agents become cheaper and more capable, security teams face a race to detect, contain, and counter campaigns before hundreds of separate breaches become the next routine operation.
Based on
