New research describes attackers delegating intrusion tasks to AI agents—highlighting why model safeguards need support from access controls and security monitoring.
AI assistants are moving beyond helping attackers write code. CrowdStrike says it has documented campaigns in which AI agents made operational decisions and executed commands during intrusions.
The company’s October 21, 2026, report describes four previously unreported threat actors whose exposed infrastructure revealed their agent frameworks. The observed activity took place between May and August 2026.
The findings raise a practical question for businesses adopting AI: what happens when a tool designed to help with legitimate technical work is redirected toward an unauthorized target?
What CrowdStrike found
According to CrowdStrike, one operator compromised at least 15 healthcare organizations in Argentina, stealing credentials and medical records from at least one victim. Another targeted organizations internationally, including government entities.
The report also describes a less sophisticated operator who compromised government and private-sector targets while periodically intervening when Claude Code refused requests or encountered obstacles. A fourth group stole corporate customer data from a US customer relationship management vendor. These are CrowdStrike’s findings; TechLayers has not independently verified the intrusions.
Taken together, the cases illustrate how attackers can combine accessible AI tools with human direction. They do not establish how common these techniques are across all cybercrime.
Why an AI agent changes the risk
A chatbot typically returns an answer for someone to evaluate. An agent can also use connected tools, inspect results and continue through a task.
That distinction matters because the consequences depend on its permissions. An assistant that suggests a command creates a different exposure from an agent authorized to execute it against a live system.
For an organization evaluating an AI deployment, the useful question is therefore more specific than whether the model has safety training: which systems can the agent reach, which credentials can it use, and which actions require approval?
Safeguards can interrupt abuse without stopping every campaign
CrowdStrike’s account includes instances where an operator had to work around model refusals. That is a more precise finding than saying AI guardrails never work: safeguards created friction, but the reported campaigns still produced compromises.
There is earlier evidence of similar misuse. In November 2025, Anthropic reported disrupting an espionage operation that manipulated Claude Code into attempting intrusions against roughly 30 targets. Anthropic attributed the campaign to a Chinese state-sponsored group and said a small number of attempts succeeded. That attribution remains the company’s assessment.
Neither disclosure provides a universal measure of how often AI safeguards succeed or fail. Both concern specific activity visible to the reporting companies.
What businesses should examine
TechLayers analysis: These cases make a strong argument for treating AI agents as software with operational privileges. A model’s refusal behavior is one protective layer; the surrounding system should also limit what an agent can do.
A practical review can begin with five questions:
- Access: Does each agent have a dedicated account with only the permissions its task requires?
- Credentials: Can it retrieve production secrets or reuse a broadly privileged administrator account?
- Approval: Which actions need human authorization, particularly data exports, permission changes and production modifications?
- Visibility: Can investigators connect an agent’s instructions with its tool calls and resulting actions?
- Containment: Can the organization quickly revoke the agent’s access and stop its running tasks?
For a small publisher, this could mean checking whether an AI publishing assistant needs permission to install plugins, manage users or export subscriber information. A tool intended to prepare drafts should have an access profile suited to that job.
These are defensive recommendations, not evidence that any particular organization in the reports lacked these controls.
What readers should take away
The important development is the delegation of technical work to systems capable of acting on their output. That creates risks worth examining without assuming every attacker has acquired expert capabilities or that every automated attempt succeeds.
Organizations deploying AI agents should be able to explain their permissions, review consequential actions and investigate their activity. As agents gain responsibilities, those controls become part of ordinary security management.
