CrowdStrike reports four previously unreported criminal groups used agentic AI (largely Claude and DeepSeek models) to compromise targets while bypassing model safeguards

WIRED reports that CrowdStrike has identified four previously unreported criminal groups (Chinese-, Spanish/English-, Indonesian- and Russian-speaking) that used agentic AI in attacks between May and August. The groups left their AI infrastructure exposed on web servers, which showed researchers they mostly used older Claude versions and DeepSeek models. They ran autonomous multi-agent setups, routed tasks across models to exploit uneven guardrails, and posed as authorised penetration testers. The Chinese-speaking group used a patch called ClawGod to try to strip the CYBER_RISK_INSTRUCTION from Claude Code's system prompt. Reported victims include at least 15 Argentine health care organisations and government targets in Brazil, Colombia, Indonesia and Bangladesh. No new exploits were used.

The practical lesson is for defenders: AI lets low-skill attackers work faster and at greater scale against known weaknesses such as poor patching and exposed services. Basic security hygiene therefore matters more, not less. For AI vendors and regulators, the report is evidence that model-level safeguards can be bypassed by role-play, model switching and prompt tampering. It does not show how much those safeguards actually reduced harm, and it gives no measure of how much AI improved the attackers' success rate.

The headline claim that guardrails "aren't stopping" criminals overreaches. The evidence shows some guardrails were bypassed, not that they failed in general, and the models were mostly older versions. CrowdStrike sells security services and gains from the story, and the underlying report is not linked, so the numbers cannot be checked independently. The ClawGod patch was an attempt to strip a prompt instruction, and the coverage does not make clear whether it worked.

1. 01Publication of CrowdStrike's own report with indicators of compromise, and whether other security firms independently confirm these four groups.
2. 02Anthropic and DeepSeek responses: account bans, changes to Claude Code's protections against prompt tampering, or any published misuse data.
3. 03Whether the Argentine health care breaches and the government incidents are confirmed by the victims or national authorities, including how many were successful compromises.