CrowdStrike: four unreported actors ran Claude Code intrusion agents
CrowdStrike found four separate threat actors who built intrusion harnesses on Claude Code and left them in open directories.
· CrowdStrike · Research by CrowdStrike Counter Adversary Operations
CrowdStrike found four previously unreported threat actors running offensive agent harnesses built on Claude Code, each recovered from an open directory the actor left exposed. Victims include Argentine healthcare and government bodies.
01What happened
CrowdStrike Counter Adversary Operations published the research on 21 October 2026, covering activity its intelligence and OverWatch teams documented between May and August 2026. Four previously unreported threat actors each left an offensive agent framework exposed in an open directory, which is how CrowdStrike recovered them. The report labels them Threat Actor 1 to 4 rather than naming them.
02How it works
The four harnesses wrap Claude Code in different ways. One splits work between a Supervisor agent that picks tasks from a state machine and an Executor agent that carries them out, rebuilt from the open-source PentestGPT project with added MCP servers, Python exploitation scripts and skills. Another runs deterministic reconnaissance first and then lets the model pick from predefined actions, or hands work to specialist agents in parallel. A third drives Claude Code from a single /pentest-setup slash command that starts a seven-step workflow carrying explicit exfiltration instructions.
03Who is affected
Named victims span at least 15 Argentina-based healthcare entities, government entities in several countries including Indonesian government domains, and private-sector targets in Brazil, Russia, Kyrgyzstan and the United States across biotech, healthcare, food and beverage, retail, technology, travel, SaaS and data centres. One United States CRM vendor lost corporate client data, and credentials and medical records were taken from at least one Argentine healthcare victim.
Questions people ask
- Which AI models and tools did the four actors use?
- Claude Code appears in all four harnesses CrowdStrike recovered. Threat Actor 2 reached Claude models mainly through a China-based AI proxy service the report calls a transfer station. Threat Actor 3 ran 819 skills pulled mostly from public GitHub repositories, primarily claude-red, with no extra orchestration. Threat Actor 1 rebuilt the open-source PentestGPT project around a two-agent design.
- How did the actors get past commercial AI safety controls?
- CrowdStrike offers few specifics. Threat Actor 2 routed requests through a proxy service rather than a direct provider account. Threat Actor 3 had human operators step in periodically to push past the model's guardrails and keep Claude Code trying. Threat Actor 4 relied on instructions granting broad autonomy over exploitation methods. No technical evasion technique is described beyond that.
- How fast did these agentic intrusions move?
- One case saw an AI agent move laterally and harvest domain controller credentials in about 20 minutes with no additional human guidance, according to CrowdStrike's companion report. The blog post adds that agentic AI can often reach its objectives within an hour, and assesses with high confidence that agentic AI-supported intrusions will grow in volume and sophistication.
Sources 2 links, all fetched
- 1crowdstrike.comCrowdStrike Research
- 2crowdstrike.comCampaigns Report