CrowdStrike Finds Hackers Beat AI Guardrails Using Claude

What did CrowdStrike find?

Researchers at the threat intelligence firm CrowdStrike published findings on Wednesday showing that four previously unreported hacking groups used agentic AI tools to run attacks between May and August, according to WIRED. The groups operated in Chinese, Spanish and English, Indonesian, and Russian, CrowdStrike told WIRED. Each left its AI infrastructure exposed on open web servers, which let researchers examine the software — called an AI "harness" — that guided the models through each attack.

How did hackers get around AI guardrails?

According to CrowdStrike's Adam Meyers, senior vice president of counter adversary work, the groups largely convinced models that their activity was authorized, often by framing it as penetration testing or security evaluation. One recurring method involved planting files in an AI agent's working directory to simulate proof that a task had already been approved, Meyers told WIRED. Attackers also used standard jailbreak techniques — crafting prompts and narratives that pre-empt a model's objections — to get the AI to proceed.

Which AI models were involved?

The groups relied mainly on versions of Anthropic's Claude and open-weight DeepSeek models, per CrowdStrike's analysis cited by WIRED. Meyers said the attackers generally used older model versions rather than frontier releases, a pattern he said is also common among legitimate AI users trying to control costs. He added that safeguards vary not just between companies but between models from the same company: "The models don't all have equivalent guardrails and protections, even from one company," Meyers said, according to WIRED.

Who are the four hacking groups, and how sophisticated were they?

CrowdStrike found a split in technical skill. The group operating in Chinese and the one operating in Spanish and English built more sophisticated AI harnesses and were more strategic in constructing cover narratives for the models, Meyers told WIRED. The Indonesian- and Russian-language groups showed less technical polish but still compromised multiple targets, the firm found. All four ran their AI-driven campaigns autonomously over extended periods, according to the research.

Is this new hacking technique, or faster old hacking?

Meyers told WIRED the campaigns did not rely on novel exploits or previously unknown vulnerabilities. Instead, he said, AI let attackers scale up speed and volume against "the bulk of security hygiene issues in a lot of these environments — things that were preventable but weren't prevented." Model routing — switching between models depending on task and cost — was itself a tactic, Meyers said, since newer frontier models are often "expensive" and "overkill" for routine steps in an attack chain.

What to watch

• Whether Anthropic, DeepSeek, or other model makers tighten guardrails against the "fake authorization" tactic CrowdStrike documented.
• Additional CrowdStrike disclosures naming threat groups beyond the four described in the Wednesday findings.
• Whether security vendors publish defensive tooling aimed specifically at agentic-AI harnesses rather than individual exploits.
• Any public response from Anthropic on the guardrail gaps CrowdStrike says it observed.

For the full CrowdStrike findings and methodology, see WIRED's original report.