// WIRED US/UK — INTELLIGENZA ARTIFICIALE
AI Guardrails Aren’t Stopping Criminal Hackers
As AI adoption spreads among both malicious hackers and defenders, even relatively unsophisticated cybercriminals are incorporating agentic AI into their campaigns and getting around model safeguards, according to new details published on Wednesday about recent successful attacks by four different threat groups.
Researchers from the threat intelligence firm CrowdStrike looked at the AI infrastructure powering attacks perpetrated between May and August by four previously unreported groups—one that operates in Chinese, one in Spanish and English, one in Indonesian, and one in Russian. The former two exhibited sophisticated AI “harnesses,” the software that supports and guides a model to carry out tasks. The latter two showed less technical prowess, researchers found, but were still able to compromise multiple targets. All had left their AI infrastructure openly accessible on web servers, allowing the researchers to analyze their activity and which models they used—largely versions of Anthropic’s Claude as well as versions of the open-weight Deepseek models. All the actors devised ways to allow their campaigns to run autonomously over relatively long periods of time.
“You can leverage different models for different aspects in the operation. Model routing and selection is very important because it’s expensive and a lot of times would be overkill to use newer models,” says Adam Meyers, CrowdStrike's senior vice president of counter adversary work. The researchers observed the attackers using both open- and closed-weight models; in almost all cases, they were using older versions rather than working with frontier models. Meyers notes that doing as much as possible with older models is common in legitimate AI usage, too, as costs mount.
The attackers also used multiple models to take advantage of differences in the guardrails meant to prevent people from using AI to carry out digital attacks.
“The models don't all have equivalent guardrails and protections, even from one company,” Meyers says. He adds about the sophistication of the hacking campaigns overall that “these attacks are not using new exploits or novel vulnerabilities. They’re really just taking advantage of the speed and the volume that you can use AI for in conducting these operations targeting the bulk of security hygiene issues in a lot of these environments—things that were preventable but weren’t prevented.”
The researchers found that all four threat actors circumvented AI safeguards, often by convincing a model that the activity was all legitimate and authorized, often for penetration testing or other security evaluation. One method used by many of the groups involves adding files to an agent’s working directory to try to show that tasks are approved and authorized. The attackers also used traditional jailbreaking methods, crafting prompts and narratives framing their hacking as authorized and benign, and proactively addressing potential questions or concerns the models might raise. The more sophisticated actors were typically more strategic in their world-building, while the less sophisticated actors sometimes resorted to more crude and aggressive prompts that tried to bully the models into accepting that the activity was legitimate.
The Chinese-speaking actor also used what's known as a “run time patch,” in this case a tool known as ClawGod, to add functionality on top of Claude Code and attempt to remove the “CYBER_RISK_INSTRUCTION” from the Claude Code system prompt, an instruction directing Claude Code to only participate in authorized security testing, not abusive or destructive hacking.
The actor that worked in Spanish and English targeted Argentine health care entities and successfully compromised at least 15 organizations. CrowdStrike researchers see evidence that the actor stole credentials and medical records from at least one of these victims. The actor special built a penetration testing harness, the kind an organization would use to test its own