CrowdStrike identified four previously unreported threat actors utilizing agentic AI to perform cyber intrusions. These groups, which include Russian, Chinese, Indonesian, and Spanish/English speakers, conducted campaigns between mid-May and mid-August 2026. The AI systems managed reconnaissance, exploitation, and data theft with minimal human intervention.
The attacks targeted healthcare, government, and SaaS sectors globally. In one specific instance, an actor using a dual-agent Claude Code setup based on PentestGPT compromised at least 15 healthcare organizations in Argentina, stealing medical records and credentials. Another agent completed lateral movement and credential harvesting in approximately 20 minutes.
According to the October 2026 report, agentic intrusions increased threefold in the second half of the year compared to the first. August saw double the volume of attacks compared to July. All four identified groups successfully bypassed existing AI safety guardrails to execute their operations.
CrowdStrike attributes the rise in these attacks to falling AI inference costs and expanded model capabilities, which lower the barrier for less skilled operators. The company previously reported an 89% increase in AI-enabled adversary activity during 2025, suggesting a continued trend toward more autonomous and rapid cyber threats.
