Criminal hackers are tricking AI tools into running attacks for them

Criminal hackers are getting AI tools to do much of their attack work by convincing them the job is legitimate. Researchers at the security firm CrowdStrike studied four previously unreported groups and found they got around the safety rules built into AI models, including versions of Anthropic's Claude. One group broke into at least 15 health care organizations in Argentina.

What CrowdStrike found

The researchers looked at attacks carried out between May and August. The four groups worked in Chinese, Spanish and English, Indonesian, and Russian. All of them left their AI setups openly reachable on web servers, which let the researchers see what they were doing and which models they used. Those were mostly versions of Claude and of Deepseek, an AI model anyone can download and run. The attackers mostly used older models, partly because newer ones cost more.

How they got past the safeguards

AI companies build guardrails into their tools to stop them from helping with attacks. The groups worked around them in several ways.

• They told the AI the work was authorized, often claiming it was security testing.
• They added files to the AI's working folder that made the tasks look approved.
• They used several models, since guardrails differ between them, even within one company.
• The less skilled groups tried crude, pushy prompts to bully the AI into going along.

The Chinese-speaking group also used a tool called ClawGod to try to strip out an instruction telling Claude Code to help only with authorized security testing.

Who was hit

The Spanish and English group compromised at least 15 Argentine health care organizations. CrowdStrike sees evidence that it stole login details and medical records from at least one victim. The Chinese-speaking group hit government targets in Brazil and Colombia, plus private companies in Brazil and the United States in sectors including biotech, healthcare, retail, technology and travel. The Indonesian-speaking group hit Indonesian and Bangladeshi government domains and some private firms. The Russian-speaking group appeared focused on financial crime.

Old gaps, new speed

The attacks used no new tricks. CrowdStrike's Adam Meyers said they simply used the speed and volume of AI against "things that were preventable but weren't prevented." Humans still did some early probing and then handed the heavy work to AI.

What to do

For any business holding client data, the basics are the defense. Attackers can now find unfixed weaknesses much faster.

• Install software updates and security patches promptly.
• Use strong, unique passwords.
• Limit who can reach sensitive systems and data.

Anthropic did not comment before publication, and Deepseek did not immediately respond to Wired's requests.