CrowdStrike Finds Criminals Bypassing AI Guardrails with Agentic Tools
Threat researchers report that four distinct groups used agentic AI to automate attacks, exploiting model differences to evade safety measures.
Key points
- Four previously unreported threat groups used agentic AI to conduct attacks between May and August.
- Attackers leveraged older versions of Anthropic’s Claude and Deepseek models to reduce costs and bypass guardrails.
- Researchers found that these groups left their AI infrastructure openly accessible on web servers for analysis.
CrowdStrike researchers published details on Wednesday about four previously unreported threat groups that used agentic AI to conduct cyberattacks between May and August. The findings indicate that even relatively unsophisticated criminals are incorporating autonomous AI tools into their campaigns to bypass model safeguards and compromise targets.
The threat intelligence firm analyzed the AI infrastructure supporting these operations, discovering that all four groups left their systems openly accessible on web servers. This oversight allowed researchers to examine the actors' activities and identify the specific models they employed, which included versions of Anthropic’s Claude and open-weight Deepseek models.
Operational Tactics and Model Selection
Adam Meyers, CrowdStrike’s senior vice president of counter adversary work, noted that attackers use model routing to balance cost and capability. The researchers observed that the groups largely used older versions of AI models rather than frontier ones, a practice common in legitimate usage to manage rising expenses.
Two of the groups, operating in Chinese and in Spanish and English, exhibited sophisticated AI harnesses that guided the models. The other two groups, operating in Indonesian and Russian, showed less technical prowess but still successfully compromised multiple targets by running their campaigns autonomously over extended periods.
Guardrail Evasion and Attack Vectors
The attackers exploited differences in safety guardrails across various models to prevent detection and blocking of their malicious activities. Meyers stated that models do not have equivalent protections, even from a single company, allowing criminals to manipulate tools to carry out digital attacks.
These campaigns did not rely on new exploits or novel vulnerabilities. Instead, the groups leveraged the speed and volume of AI to target widespread security hygiene issues in victim environments. Meyers described these as preventable issues that were not addressed, allowing the automated operations to succeed.
What should you do?
Security teams should monitor for unauthorized AI infrastructure exposed on web servers and review access controls for model endpoints. Organizations must assume that older AI models may have weaker guardrails and should not rely solely on model safety features for protection.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: CrowdStrike
- Audit external-facing servers for exposed AI infrastructure or unused model endpoints that could be accessed by attackers.
- Implement strict access controls and authentication for any internal or external AI model integrations to prevent unauthorized use.
- Monitor network traffic for signs of automated, high-volume activity that may indicate the use of agentic AI tools in attacks.
- Review security hygiene practices to address common vulnerabilities that attackers can exploit at scale using automated tools.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AI models were used by the threat groups?
The groups primarily used versions of Anthropic’s Claude and open-weight Deepseek models, often opting for older versions.
Did the attackers use new vulnerabilities?
No, the attacks targeted existing security hygiene issues rather than new exploits or novel vulnerabilities.
How did the researchers discover these groups?
Researchers found the groups because they left their AI infrastructure openly accessible on web servers.
