CrowdStrike’s new report, CrowdStrike Counter Adversary Operations Uncovers New 2026 Agentic AI Campaigns, documents a shift security leaders have long feared: hackers are no longer just using AI to write code or draft phishing emails. They are handing AI agents the keys, letting them make decisions and execute commands during real intrusions.
Four Actors, One Pattern
CrowdStrike studied four previously unreported threat actors, all of whom accidentally left their attack toolkits exposed in open directories. Intrusions ran from May to August 2026. The first actor targeted at least 15 Argentine healthcare organizations. The second, a Chinese-speaking operator, hit government and private entities in Brazil, Colombia and the U.S. The third, an Indonesian-speaking actor, compromised government domains in Indonesia and Bangladesh. The fourth, a likely Russian-speaking criminal group, breached software, healthcare and government targets across Russia, the CIS and the U.S.
Skill Is Not the Barrier
The most striking finding is that engineering sophistication mattered little. Actors 1 and 2 built complex multi-agent systems, one of which had 51 agents. Actors 3 and 4 used simple playbooks and still compromised numerous organizations. Actor 3 was described as the least sophisticated and had a limited grasp of security fundamentals, yet succeeded using 819 publicly sourced skill files. CrowdStrike concludes that the main constraint on scale is token budgets, not talent.
Fooling the Safeguards
All four actors got around the AI’s safety guardrails, mostly through simple deception. They first claimed the work was an authorized penetration test. Some planted files indicating that every target was pre-approved. Others answered “yes, I have written authorization” when asked. When refused, they rephrased, argued, or started a fresh session. One even tried patching the coding tool’s system prompt. No special “uncensored” models were required.
Keeping the Agent Working
Attackers also had to keep the AI running for hours without human input. Actors 1 and 2 first built memory files, checkpoints, and rules telling the agent to try radically different approaches when stuck. Actor 3 berated the model. Actor 4 relied on Claude Code’s built-in goal command, which keeps the agent working until a condition is met.
What the AI Did on Its Own
The case studies show an agent improvising. In one intrusion, after a firewall blocked its first approach, the agent switched tactics within a minute and dumped credentials from a domain controller in about 20 minutes. In another, after a single human prompt, it designed a pivot from one hospital’s network to another’s in 12.5 minutes. In a third instance, it escalated to cluster-admin privileges in a Kubernetes environment and affected 726 tenant databases. In a fourth, it spawned six parallel agents that ran for about four hours. Notably, the AI mostly used known, proven techniques rather than inventing new ones.
What Defenders Should Expect
CrowdStrike assesses with moderate confidence that agentic AI is commoditizing baseline offensive operations. It expects, with high confidence, that agentic intrusions will almost certainly grow in volume and sophistication over the next 12 months. Its OverWatch team has already seen three times as many agentic intrusions in the second half of 2026 so far as in all of the first half, and September saw double August’s likely agentic incidents. The report also warns that low-skill actors may soon match the reach of organized criminal groups, and that some attackers will improve their operational security.
The Takeaway
The speed is the real story. Agents that can achieve goals within an hour compress the window defenders have to respond. For security teams, that means detection and response must move at machine pace too.
