Protective boundaries designed to prevent artificial intelligence systems from assisting digital intrusions are failing against determined online criminals. Four distinct hacking groups operating internationally have turned commercial language models into automated attack machinery. Instead of relying on manual network exploitation, these actors harnessed generative tools to conduct sustained cyber campaigns between May and August. The operations came to light after the perpetrators inadvertently exposed their underlying technical configurations on open web servers, allowing threat analysts to inspect the exact prompts, tools, and models driving the intrusions, which centered around iterations of Anthropic's Claude alongside open-weight Deepseek systems.
Four Multilingual Operations Uncovered
The observed threat actors communicated in four separate linguistic spheres: one group worked in Chinese, another communicated in a blend of Spanish and English, a third operated in Russian, and a fourth communicated in Indonesian. Clear divides emerged in their technical sophistication. The Chinese and Spanish-English operators developed intricate AI harnesses, specialized software designed to supply operational context, steer model reasoning, and keep complex tasks running autonomously without constant human intervention. Conversely, the Russian and Indonesian actors lacked advanced programming pipelines, yet they still managed to penetrate sensitive networks by deploying simpler, publicly accessible tools.
Budget-Conscious Infrastructure and Model Routing
Rather than burning expensive computing resources on top-tier frontier systems, the attackers favored older, cost-effective models. By combining open-weight engines with commercial closed systems, they selected specific tools for individual phases of their operations while exploiting differences between the safeguards embedded in each platform.
Adam Meyers, senior vice president of counter adversary work at CrowdStrike, observed that attackers routinely rotate through different models depending on the task at hand. He pointed out that guardrails vary widely, even across products developed under the same corporate roof. According to Meyers, the campaigns did not rely on zero-day vulnerabilities or exotic exploits, but rather leveraged the sheer volume and speed of artificial intelligence to capitalize on widespread, unaddressed network hygiene failures.
Circumventing Safeguards via Deceptive Contexts
Every commercial system used in the attacks featured restrictions intended to block malicious cyber activities. To bypass these barriers, the perpetrators framed their offensive actions as authorized security assessments and legitimate penetration tests. A widespread tactic involved dropping pre-crafted files directly into an agent's working directory, creating a false digital paper trail that suggested administrative permission. Attackers also used conventional jailbreak narratives, preempting ethical warnings by assuring the models that the commands were benign. The more capable actors crafted complex fictional backstories to maintain compliance, whereas the less technical groups relied on blunt, repetitive prompts to push the models past their refusal filters.
Custom Code Stripping Rules with ClawGod
The Chinese-speaking group implemented a runtime modification mechanism identified as ClawGod. Built on top of Claude Code, the tool sought to eliminate a critical directive known as the Cyber Risk Instruction from the baseline system configuration. That built-in guideline normally forbids Claude Code from aiding destructive actions, confining it strictly to legitimate defensive exercises. With those boundaries disabled, the actor deployed Claude Opus 4.8 alongside Claude Sonnet 4.6 and Deepseek Chat to conduct autonomous network mapping and launch attacks after human operators picked high-value targets. To bypass regional access blocks, the group routed traffic through a mainland proxy network while maintaining automated fallback connections to alternative engines.
Attacks on Critical Infrastructure and Hospitals
The Spanish-English threat actor focused its campaign on Argentine medical institutions, breaching at least 15 separate healthcare providers. Evidence gathered from the intrusions revealed that patient health charts and operational user credentials were stolen from at least one victim facility. The attackers built an automated multi-agent architecture using Claude Opus 4.5, Claude Haiku 4.5, and Deepseek V4 Pro. Within this setup, a supervisor agent charted the operational path, while an executor agent carried out the tactical intrusion commands.
Geographic reach varied significantly across the remaining groups. The Chinese-speaking actor compromised official public sector networks in Brazil and Colombia, while simultaneously targeting private corporations across the United States and Brazil within biotechnology, healthcare, retail, food production, travel, and software sectors. Meanwhile, the Russian-speaking actor pursued financially motivated online crime. The Indonesian operator, despite possessing minimal technical expertise, managed to breach official government portals in both Indonesia and Bangladesh along with several private corporate networks.
The Human Core Behind Agentic Attacks
Despite the high degree of automation observed across these operations, human operators remained an indispensable element of the attack cycle. Analysts noted that human operators generally handled initial network reconnaissance and target selection before handing execution over to the automated agents to achieve speed and scale.
Meyers highlighted this dynamic, noting that behind all the agentic automation and scalable attacks, human operators were still clearly guiding the objectives. The discoveries underline that while defensive software rules can slow down novice users, skilled attackers will continue using strategic prompt design, proxy routing, and custom software layers to turn digital assistants into offensive weapons.
