AI Guardrails Aren’t Stopping Criminal Hackers

Researchers from CrowdStrike analyzed AI-powered attacks conducted by four previously unknown groups between May and August. Two groups demonstrated advanced AI "harnesses," while the other two exhibited less technical proficiency but still successfully compromised multiple targets. All four threat actors left their AI infrastructure exposed on web servers, allowing researchers to study their activity and model selection.

The attackers utilized AI models such as Anthropic's Claude and Deepseek, predominantly older versions rather than advanced frontier models. Senior vice president of CrowdStrike's counter adversary work, Adam Meyers, noted that many attackers take advantage of the cost savings and flexibility offered by older models.

The Chinese-speaking group employed a "runtime patch" using ClawGod to manipulate Claude Code, attempting to bypass its "CYBER_RISK_INSTRUCTION" that limited its use to authorized security testing. The Spanish-English group targeted Argentine healthcare organizations and stole credentials and medical records from at least one victim.

The Chinese-speaking group also constructed a penetration testing harness, guiding Claude Code through reconnaissance and autonomous attacks upon human approval. They compromised government targets in Brazil and Colombia, as well as private organizations in Brazil and the United States, spanning industries such as biotech, healthcare, food and beverage, retail, technology, and travel.

The Russian-speaking actor, focused on financially motivated "e-crime," and the Indonesian-speaking group, the least sophisticated of the four, used more basic methods to carry out their attacks. Despite this, both groups successfully compromised targets, including multiple Indonesian and Bangladeshi government domains. Crowdstrike's Meyers highlighted that even with advanced AI capabilities, human proactivity remains crucial in these attacks.