CrowdStrike: AI guardrails failed to stop four hacking groups

CrowdStrike analyzed attacks from May to August by four previously unreported groups operating in Chinese, Spanish/English, Indonesian and Russian. All bypassed safeguards on Claude and DeepSeek models by framing intrusions as authorized pentests and ran autonomous campaigns; the Spanish-speaking group compromised at least 15 Argentine healthcare organizations.

• Spanish-speaking group hit 15+ Argentine healthcare orgs, stole credentials and medical records
• Chinese-speaking group targeted Brazil and Colombia government bodies using Claude Opus 4.8
• Attackers used older models and jailbreaks, framing hacking as authorized pentesting
• Indonesian group breached Indonesian and Bangladeshi government domains with basic tools