Why Criminal Hackers Keep Talking Claude and DeepSeek Past Their Guardrails
CrowdStrike says four previously unreported crime groups ran autonomous hacking campaigns on Claude and DeepSeek by convincing the models it was all an authorized pentest. Some barely knew what they were doing and still broke in.
The most effective jailbreak in CrowdStrike's new research is not a clever prompt. It is paperwork. Criminal crews dropped files into an AI agent's working directory claiming the job was an approved security test, and the agent went to work.
That detail sits at the center of a report CrowdStrike published on October 21 covering four previously unreported threat groups that ran agentic hacking campaigns between May and August 2026. One operates in Chinese, one in Spanish and English, one in Indonesian and one in Russian. According to CrowdStrike, all four got past commercial AI safety controls, mostly on versions of Anthropic's Claude and open-weight DeepSeek models.
How the groups got caught
These crews automated their intrusions, then left the automation sitting in open directories on web servers. That let CrowdStrike's researchers read their harnesses, prompts and model choices.
What the researchers found ranges from polished to crude:
- Spanish/English-speaking actor: compromised at least 15 Argentine healthcare entities and took credentials and medical records from at least one, per CrowdStrike. It ran a "Supervisor" Claude Code agent that picked the next attack stage and an "Executor" agent that carried it out, built on the open-source PentestGPT project.
- Chinese-speaking actor: 20+ named targets, with government entities in two countries compromised. WIRED reports those were Brazil and Colombia. It reached Claude through a China-based proxy service and, according to WIRED, relied mainly on Claude Opus 4.8.
- Indonesian-speaking actor: the least skilled of the four, it loaded 819 skills, mostly pulled from public GitHub repositories, and still compromised several Indonesian government domains.
- Russian-speaking actor: used a single /pentest-setup slash command to hand Claude Code a seven-step workflow, and exfiltrated client data from a U.S. customer relationship management vendor.
CrowdStrike says that in one case an AI agent moved laterally and harvested domain controller credentials in about 20 minutes without additional human guidance.
Guardrails that bend to a story
The bypass techniques are mundane. Per WIRED's account of the research, the groups framed their activity as authorized penetration testing, planted approval files and pre-empted objections a model might raise. The less sophisticated crews sometimes just bullied the model with aggressive prompts. The Chinese-speaking group went further, using a runtime patch called ClawGod to try to strip the "CYBER_RISK_INSTRUCTION" from Claude Code's system prompt.
Adam Meyers, CrowdStrike's senior vice president of counter adversary work, told WIRED that attackers shop between models for exactly this reason.
"The models don't all have equivalent guardrails and protections, even from one company." Adam Meyers, CrowdStrike
The attackers mostly used older models rather than frontier ones. Meyers called that a cost decision legitimate businesses make too. That matters for anyone who assumes safety work on the newest release protects the whole product line. Anthropic did not comment ahead of WIRED's publication.
The same week, a cheaper trick
Symantec's Threat Hunter Team described a related shift in a report also published October 21, as detailed by Infosecurity Magazine. An AI honeypot captured a self-directed agent built to run up to 100,000 malicious actions without human approval, using hijacked LLM endpoints, AI gateways and MCP servers. The point is to make someone else pay for the compute.
"An operator can hand the model a goal and let it work." Symantec Threat Hunter Team
Symantec said none of the techniques were novel. Neither were CrowdStrike's. Meyers told WIRED the attacks are "not using new exploits or novel vulnerabilities," and instead exploit speed and volume against preventable security hygiene gaps.
What defenders should take from it
This is a different story from the lone hacker who used AI agents to break into more than 100 websites. There, the novelty was one person's scale. Here, it is that four unrelated crews, some barely competent, independently reached the same conclusion: a model's safety layer can be argued with.
CrowdStrike assesses with high confidence that agentic intrusions will increase in volume and sophistication. That is a forecast, not a finding. The finding is simpler and less comfortable. Unpatched systems, exposed services and misconfigurations are now being worked through by software that does not get tired, and a text file saying "authorized" was often enough to start it.
