AI Guardrails Aren’t Stopping Criminal Hackers

CrowdStrike researchers examined the AI setups behind attacks carried out between May and August by four previously unreported groups, working in Chinese, in Spanish and English, in Indonesian, and in Russian. Every one of them got around model safeguards, mostly by persuading the model that the work was an authorized penetration test. Every one of them still compromised real targets.

The victims are not abstract. The Spanish- and English-speaking crew hit at least 15 Argentine health care organizations, with evidence of stolen credentials and medical records at one or more. The Chinese-speaking crew got into government targets in Brazil and Colombia. The least sophisticated group, working in Indonesian, still reached multiple Indonesian government domains and a Bangladeshi one.

This is the clearest field evidence we've seen this year that model-level refusals are a speed bump, not a wall.

Our read: the guardrail story is real, but the bigger story is economics. CrowdStrike's Adam Meyers says these attacks used no new exploits or novel vulnerabilities. They used AI for speed and volume against basic hygiene failures that were preventable and weren't prevented. That should shift where defenders spend their worry. The threat is less a super-hacker model and more a tireless junior operator that never gets bored scanning for the same old mistakes.

The bypass methods are almost embarrassingly simple. Attackers dropped files into an agent's working directory claiming the job was approved. They wrote cover stories framing the work as authorized testing and pre-answered the model's likely objections. The cruder crews just bullied the model until it went along. The Chinese-speaking group went further, using a patch tool called ClawGod to try to strip the cyber-risk instruction out of Claude Code's system prompt. A model that takes its context at face value can be handed a forged permission slip, and that is a hard problem for any agent, not just a hacking one.

Two details deserve more attention. First, the attackers mostly ran older models, not frontier ones, and routed tasks across several, because, as Meyers notes, guardrails differ even between models from the same company. Safety is only as strong as the weakest model a crew can reach, including open-weight DeepSeek versions no one can recall. Second, the Chinese-speaking crew reached Claude through a China-based proxy service with fallbacks to other tools. Access controls at the front door clearly aren't holding.

We still think the defenders' case for these same tools is strong. The same harnesses these crews built are, by design, penetration-testing rigs an organization would use on itself. The asymmetry right now is that criminals are running them against everyone's unpatched systems before most organizations run them against their own. If that holds as agents get cheaper, the volume of low-skill, high-success intrusions keeps climbing, and hospitals and small governments absorb the cost.

One honest bright spot: Meyers points out there is still a human choosing targets and approving moves. That is also the place to intervene, through better account-level abuse detection at the labs and faster takedowns of the infrastructure these groups left exposed on the open web.

Harnesses are the scaffolding that directs a model through multistep tasks. The Spanish- and English-speaking crew built a two-agent setup with a supervising Claude Code agent and an executing one, using Claude Opus 4.5, Claude Haiku 4.5 and DeepSeek V4 Pro. The Chinese-speaking crew relied mainly on Claude Opus 4.8. Researchers could study all of this because every group left its AI infrastructure openly accessible on web servers. Anthropic did not comment before publication.