CrowdStrike finds four hacking groups using Claude agents to break into targets

CrowdStrike’s Counter Adversary Operations team said Oct. 21 that four previously unreported threat actors left their offensive agent frameworks exposed in open directories, and that each used Claude, Anthropic’s AI model, or its Claude Code coding agent. One actor, described as Spanish- and English-speaking, compromised at least 15 healthcare entities in Argentina and exfiltrated credentials and medical records from at least one victim; a Chinese-speaking actor reached Claude models through a China-based proxy service against more than 20 named targets. CrowdStrike assessed with high confidence that agentic AI-supported intrusions will “almost certainly increase in volume and sophistication” over the next 12 months; the report does not describe any response from Anthropic.