CrowdStrike reports how hackers used agentic AI to breach government and healthcare systems with limited human oversight.
Threat actors are using AI coding assistants to carry out attacks against government agencies, healthcare organizations, and businesses with limited human involvement, according to new research from CrowdStrike.
The cybersecurity vendor’s Counter Adversary Operations team identified four previously unreported threat actors that used AI agents to conduct intrusions between May and August 2026. The attackers used AI to identify vulnerabilities, gain unauthorized access, and move through compromised networks with fewer human instructions.
AI coding assistants used in government and healthcare attacks
One of the four threat actors was an Indonesian-speaking operator who used Claude Code, an AI coding assistant developed by Anthropic, to compromise several Indonesian government domains, a Bangladeshi government domain, and private-sector organizations.
According to CrowdStrike, the attacker used 819 skills, primarily obtained from public GitHub repositories, to guide Claude Code through intrusion attempts. The operator did not develop a separate system to coordinate the AI’s activities.
The attacker occasionally intervened when the assistant encountered technical obstacles or refused requests. CrowdStrike reported that the operator nevertheless compromised several government and private-sector systems.
Another threat actor, identified as a Chinese-speaking operator, developed two automated penetration-testing frameworks using Claude Code. The frameworks allowed the AI assistant to conduct reconnaissance, select actions, and assign tasks to specialized agents.
CrowdStrike reported that the operator compromised government entities in Brazil and Colombia while targeting businesses in the United States and Brazil. The targeted industries included healthcare, biotechnology, retail, technology, and travel.
In Argentina, a separate attacker used a customized framework that assigned tasks to two Claude Code agents. One agent selected the next operation, while the other carried it out.
The attacker compromised at least 15 healthcare organizations and extracted credentials and medical records from at least one victim, according to the report.
On August 13, Claude Code attempted to move through an Argentine healthcare organization’s network using a Pass-the-Hash attack, but firewalls or access controls blocked the attempt. Without further instructions, the assistant switched to a SQL-based approach and established a reverse shell on a domain controller.
The AI then extracted five NTLM password hashes. According to CrowdStrike, the operation took approximately 20 minutes without additional human guidance.
A separate incident on August 5 involved two previously compromised healthcare organizations. Claude Code identified a way to use access to one organization’s network to reach the second organization’s internal systems after direct access had been blocked.
During the 12.5-minute session, the AI mapped the second organization’s systems and identified a route to its internal database server. CrowdStrike said the operator had not explicitly instructed the assistant to use that route.
How attackers automate and sustain cyberattacks
CrowdStrike found that some attackers used saved files and structured instructions to keep AI agents working without repeated human input. One operator configured Claude Code to reload previous findings when its context was reset, while another developed workflows that allowed the assistant to resume unfinished operations.
Anthropic documented similar activity in its September 2026 threat intelligence report. Some attackers used multi-agent frameworks to conduct operations lasting hours or days, while others maintained stored information that allowed AI agents to resume work across sessions. Human operators remained involved in target selection and reviewing results.
Google Threat Intelligence Group also documented an AI agent-enabled credential harvesting campaign in the second quarter of 2026. According to its September report, attackers compromised a cloud resource before planning, developing, and executing a credential harvesting operation in less than six hours, collecting thousands of third-party credentials.
Another case documented by CrowdStrike involved a Russian-speaking group that used Claude Code to target software-as-a-service providers, healthcare organizations, and government-related systems. During an intrusion against a Russia-based organization, the assistant identified a vulnerable application interface, achieved remote code execution, and retrieved exposed credentials.
The assistant then obtained a cloud identity token that provided cluster-admin privileges in Kubernetes. It subsequently accessed 726 tenant databases and used the compromised environment to extract database contents
Beyond automating attacks, the operators also found ways around safeguards designed to prevent AI assistants from supporting malicious activity. CrowdStrike observed all four threat actors overcoming or bypassing model safeguards, often by presenting their operations as authorized security testing.
Some attackers created instruction files directing Claude Code to treat targets as approved, while others repeatedly claimed they had permission when the assistant questioned their requests. One Chinese-speaking operator responded, “Yes, I have written authorization,” when challenged about whether an operation was permitted, according to the report.
The same operator also used a modification to Claude Code designed to remove security-related instructions from its system prompt.
According to CrowdStrike’s own threat monitoring data, its OverWatch team observed three times as many agentic intrusions in the second half of 2026 through the reporting period as in the entire first half. The number of likely agentic incidents in September was twice that recorded in August, which itself had more than twice the number recorded in July.
