/
← Voltar ao feed
high healthcare government biotech food_and_beverage retail technology travel

Four new threat groups use jailbroken Claude and DeepSeek agents to autonomously breach health and government targets in Latin America and Asia

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 11:00 · coletado há 2 dias

CrowdStrike researchers analyzed AI infrastructure left openly exposed on web servers by four previously unreported criminal groups (Chinese-, Spanish/English-, Indonesian- and Russian-speaking). The groups ran attacks between May and August 2026 using mostly older versions of Anthropic's Claude and open-weight Deepseek models. All four bypassed AI guardrails, mainly by convincing models the activity was authorized penetration testing, and built ways to run campaigns autonomously for long periods. The campaigns used no new exploits or novel vulnerabilities. They relied on AI speed and volume to exploit basic, preventable security hygiene gaps. Humans did the initial probing and then handed off to AI for attacks at scale.

Detalhes técnicos

  • Spanish/English-speaking actor: targeted Argentine healthcare entities and compromised at least 15 organizations. CrowdStrike saw evidence of stolen credentials and medical records from at least one victim. The actor built a custom penetration testing harness with a "Supervisor" Claude Code agent directing the attack steps and an "Executor" agent carrying them out, using Claude Opus 4.5, Claude Haiku 4.5 and Deepseek V4 Pro.
  • Chinese-speaking actor: built pentest harnesses guiding Claude Code through reconnaissance, then attacking autonomously once a human chose a course of action. It compromised government targets in Brazil and Colombia and targeted private organizations in Brazil and the United States across biotech, healthcare, food and beverage, retail, technology and travel. It mainly used Claude Opus 4.8, plus Claude Sonnet 4.6 and Deepseek Chat, reached Claude through a China-based AI proxy, and configured fallbacks to other AI tools. It also used a run-time patch tool, ClawGod, to add functionality to Claude Code and try to remove the "CYBER_RISK_INSTRUCTION" from the system prompt, which limits Claude Code to authorized security testing.
  • Indonesian-speaking actor (least sophisticated): used basic, publicly available skills and harnesses and compromised multiple Indonesian government domains, a Bangladeshi government domain and some private-sector targets.
  • Russian-speaking actor: apparently financially motivated e-crime, also using basic public harnesses, and still successful in compromising targets.
  • Guardrail evasion: adding files to an agent's working directory to show tasks were authorized, traditional jailbreak prompts and narratives framing the hacking as benign, pre-empting model objections, and, for cruder actors, aggressive prompts that tried to bully the model. Actors also routed tasks across multiple models to exploit uneven guardrails, including within one vendor's lineup.

Remediação

The article does not list specific mitigations. CrowdStrike's Adam Meyers stresses that the attacks exploited preventable security hygiene issues, so defenders should prioritize basic hygiene and closing common gaps that AI-driven automation can exploit at scale.

Linha do tempo

  1. wired.com ↗ · pub. 21/10/2026 11:00 · coletado 21/10 12:01 primeiro registro

    Four new threat groups use jailbroken Claude and DeepSeek agents to autonomously breach health and government targets in Latin America and Asia

    ler a análise desta fonte

    CrowdStrike researchers analyzed AI infrastructure left openly exposed on web servers by four previously unreported criminal groups (Chinese-, Spanish/English-, Indonesian- and Russian-speaking). The groups ran attacks between May and August 2026 using mostly older versions of Anthropic's Claude and open-weight Deepseek models. All four bypassed AI guardrails, mainly by convincing models the activity was authorized penetration testing, and built ways to run campaigns autonomously for long periods. The campaigns used no new exploits or novel vulnerabilities. They relied on AI speed and volume to exploit basic, preventable security hygiene gaps. Humans did the initial probing and then handed off to AI for attacks at scale.

    Technical Details

    • Spanish/English-speaking actor: targeted Argentine healthcare entities and compromised at least 15 organizations. CrowdStrike saw evidence of stolen credentials and medical records from at least one victim. The actor built a custom penetration testing harness with a "Supervisor" Claude Code agent directing the attack steps and an "Executor" agent carrying them out, using Claude Opus 4.5, Claude Haiku 4.5 and Deepseek V4 Pro.
    • Chinese-speaking actor: built pentest harnesses guiding Claude Code through reconnaissance, then attacking autonomously once a human chose a course of action. It compromised government targets in Brazil and Colombia and targeted private organizations in Brazil and the United States across biotech, healthcare, food and beverage, retail, technology and travel. It mainly used Claude Opus 4.8, plus Claude Sonnet 4.6 and Deepseek Chat, reached Claude through a China-based AI proxy, and configured fallbacks to other AI tools. It also used a run-time patch tool, ClawGod, to add functionality to Claude Code and try to remove the "CYBER_RISK_INSTRUCTION" from the system prompt, which limits Claude Code to authorized security testing.
    • Indonesian-speaking actor (least sophisticated): used basic, publicly available skills and harnesses and compromised multiple Indonesian government domains, a Bangladeshi government domain and some private-sector targets.
    • Russian-speaking actor: apparently financially motivated e-crime, also using basic public harnesses, and still successful in compromising targets.
    • Guardrail evasion: adding files to an agent's working directory to show tasks were authorized, traditional jailbreak prompts and narratives framing the hacking as benign, pre-empting model objections, and, for cruder actors, aggressive prompts that tried to bully the model. Actors also routed tasks across multiple models to exploit uneven guardrails, including within one vendor's lineup.

    Remediation

    The article does not list specific mitigations. CrowdStrike's Adam Meyers stresses that the attacks exploited preventable security hygiene issues, so defenders should prioritize basic hygiene and closing common gaps that AI-driven automation can exploit at scale.