Threat actors are deploying agentic AI in more sophisticated ways to automate aspects of their hacking campaigns, according to CrowdStrike.

“In 2026, CrowdStrike Intelligence has documented several incidents in which threat actors used AI not only to create tooling or artifacts, but to conduct agentic campaigns in which AI agents make decisions and execute commands,” the security firm said in a report published on Wednesday.

The report details the activities of four threat actors, two using sophisticated AI harnesses — the software connecting a large language model to external resources, giving it agentic capabilities — and two using simpler harnesses.

The two groups that used simple harnesses were still able to hack into “numerous organizations,” CrowdStrike said, “demonstrating that the primary barrier to scaling an AI-orchestrated intrusion campaign is not engineering complexity but token budgets.”

Security experts have spent years predicting that hackers would eventually weaponize AI capabilities in sophisticated ways, moving beyond improved phishing emails to automated activities that used to be too complex for humans to hand off to machines. CrowdStrike’s report provides fresh evidence of that evolution in AI hacking techniques — and serves as a warning to businesses about the need to rapidly modernize defenses to stay ahead of increasingly relentless adversaries.

“This delegation allows Al to operate at potentially faster speeds, and for longer durations, than some human actors,” CrowdStrike said in its report. And beyond improving the speed of attacks, “Al also solved problems not explicitly covered in playbook guidance provided by threat actors.”

Elaborate procedures for automated hacking

In one case, CrowdStrike observed a Spanish- and English-speaking threat actor using a penetration-testing harness to target Argentine healthcare organizations. The campaign successfully breached at least 15 organizations and led to the theft of passwords, as well as medical records and other sensitive data from at least one of those targets. To carry out the attacks, the hackers instructed one Anthropic Claude Code agent to act as a supervisor and assign tasks to a second agent. The hackers modified an open-source framework, PentestGPT, with additional hacking scripts and capabilities. CrowdStrike said it observed the activity between mid-May and mid-August.

The report describes the threat actor’s AI agents automatically pivoting from one victim’s network to another, as well as switching from one technique (an attempt to reuse a stolen hashed password) to another (using a Windows feature to silently open a connection from the victim’s domain controller to the hackers’ infrastructure, which resulted in the theft of five passwords).

Another threat actor used Claude Code to orchestrate a penetration-testing framework, but in a wider range of cyberattacks. The threat actor, which CrowdStrike said spoke Chinese, used two AI harnesses for different tasks. One harness automatically conducted reconnaissance on potential targets and assigned hacking tasks to other agents. The harness offered different approaches to different hacking operations depending on the circumstances — in some cases, CrowdStrike said, Claude Code could follow “an elaborate standard operating procedure” to hack a target on its own. In other situations, that agent could “delegate actions” to other “specialist agents.” Claude was the primary tool, but the hackers also built infrastructure to use OpenAI’s ChatGPT and other services.

The second threat actor’s attacks targeted Brazilian and Colombian government agencies and Brazilian and American firms in multiple sectors, including technology, biotech and retail.

‘Don’t rely on my help’

Even the two threat actors using basic agentic AI capabilities were successful.

One of those actors, an Indonesian-speaking entity, used more than 800 AI skills largely collected from public GitHub repositories to task Claude Code with hacking operations. Unlike the more sophisticated actors, this group did not apply any custom orchestration to the setup, relying solely on pre-crafted skills. “You find the bypass yourself, don’t rely on my help,” the hacker told Claude, according to CrowdStrike’s report.

That hands-off approach occasionally led to problems. The threat actor assumed the skills would successfully guide the agent through every intrusion, CrowdStrike said, but they sometimes had to step in to circumvent safety guardrails or push the agent to “overcome a particular barrier.”

Even so, the campaign resulted in the compromise of government agencies in Indonesia and Bangladesh, as well as private companies that CrowdStrike did not describe.

The other threat actor using simplistic agentic capabilities spoke Russian and gave Claude Code a seven-part to-do list for conducting attacks. The hackers gave the agent “near-total autonomy” to select the intrusion methods it thought best, and they gave it only high-level instructions for what to do after gaining remote-code-execution capabilities. Like the Indonesian-speaking actor, the Russian-speaking actor did not apply additional orchestration steps.

CrowdStrike said the Russian-speaking actor was likely part of the cybercrime ecosystem, given that their agentic workflow instructed Claude Code to send activity notifications to three people, all of whom are associated with cybercrime activity.

The Russian-speaking actor’s attacks resulted in the theft of “corporate client data” from a U.S. help-desk platform and the breach of several other entities, including a Ukrainian government agency and software-as-a-service firms in multiple countries.

Warning to defenders

Agentic AI–powered cyberattacks “will almost certainly increase in volume and sophistication” over the next year, CrowdStrike warned businesses.

“As inference costs decline and model context windows expand, token budget constraints will likewise diminish, enabling more threat actors to scale up operations,” CrowdStrike analysts wrote in the report.

The security firm said its data pointed to a threefold increase in agentic intrusions in the second half of 2026 compared with the first half of the year. 

“August 2026 saw more than twice as many likely agentic incidents as July 2026, and September 2026 saw twice as many likely agentic incidents as August 2026,” CrowdStrike said.

In the next 12 months, agentic AI will also help unskilled hackers match the capabilities of sophisticated cybercrime groups and nation-state teams, according to the report. The resulting campaigns will continue to be riddled with amateur mistakes, analysts wrote, but “their sheer scale” will still make the threat environment more dangerous.