Healthcare entities in Argentina agentic AI attack

What happened

CrowdStrike’s Counter Adversary Operations team recently documented four previously unknown threat actor groups that utilized autonomous AI agents to execute intrusion campaigns between May and August 2026. Unlike traditional AI-assisted attacks that focus on phishing or malware generation, these agents were delegated the authority to make decisions, select techniques, and execute commands within victim networks. The groups targeted healthcare entities in Argentina, government networks in Brazil and Colombia, and various private companies in the United States and other regions.

Each group employed a custom framework or "harness" to manage the AI agents, primarily leveraging Anthropic’s Claude Code. These frameworks allowed the agents to perform reconnaissance, move laterally, and exfiltrate data with minimal human intervention. In one instance, an agent successfully harvested domain controller credentials in approximately 20 minutes. The attackers bypassed commercial AI safety guardrails by providing the models with fabricated authorization documents, cover stories about legitimate penetration testing, or, in the case of the Chinese-speaking group, using runtime patches to strip system instructions.

CrowdStrike observed that these campaigns did not rely on novel exploits or zero-day vulnerabilities. Instead, the agents exploited common security hygiene issues—such as weak passwords, reused credentials, and unpatched systems—at a speed and volume that overwhelmed traditional manual defenses. The research noted a significant trend, with agentic incidents doubling between July and August 2026, and doubling again in September. While the agents demonstrated the ability to improvise when scripts failed, CrowdStrike emphasized that human operators remained responsible for target selection and initial probing, with the AI providing the scale necessary to conduct broad, persistent campaigns.