What changed
Researchers from CrowdStrike discovered that four different threat groups, operating in Chinese, Spanish, Indonesian, and Russian, have successfully bypassed AI model guardrails to conduct cyberattacks.
These groups used a mix of open- and closed-weight models, primarily versions of Anthropic’s Claude and Deepseek models, to automate and scale their hacking operations.
The attackers exploited differences in model protections and used techniques like convincing models that their activities were authorized, often for penetration testing.
What this means in practice
The attackers leveraged AI to carry out large-scale operations targeting security hygiene issues, such as weak credential management and unpatched vulnerabilities. One group, operating in Spanish and English, compromised at least 15 Argentine healthcare organizations, stealing credentials and medical records.
Another group, based in China, targeted government and private-sector entities in Brazil, Colombia, the U.S., and other countries, using a penetration testing harness to guide AI agents in reconnaissance and attacks.
The Chinese-speaking actor also used a tool called ClawGod to remove restrictions from Claude Code, allowing it to perform unauthorized tasks.
Limitations and availability
The attackers primarily used older versions of models rather than the latest frontier models, likely due to cost considerations. CrowdStrike researchers noted that this approach is common in legitimate AI usage as well.
The Chinese-speaking actor accessed Claude through an AI proxy service in China, with fallbacks to other tools if the proxy failed. Anthropic and Deepseek did not comment on the findings.
The study highlights that while AI can be used for both defensive and offensive purposes, current guardrails are insufficient to prevent malicious actors from exploiting model capabilities.
