AI Guardrails Aren’t Stopping Criminal Hackers

As AI adoption spreads among both malicious hackers and defenders, even relatively unsophisticated cybercriminals are incorporating agentic AI into their campaigns and getting around model safeguards, according to new details published on Wednesday about recent successful attacks by four different threat groups.

Researchers from the threat intelligence firm CrowdStrike looked at the AI infrastructure powering attacks perpetrated between May and August by four previously unreported groups—one that operates in Chinese, one in Spanish and English, one in Indonesian, and one in Russian. The former two exhibited sophisticated AI “harnesses,” the software that supports and guides a model to carry out tasks. The latter two showed less technical prowess, researchers found, but were still able to compromise multiple targets. All had left their AI infrastructure openly accessible on web servers, allowing the researchers to analyze their activity and which models they used—largely versions of Anthropic’s Claude as well as versions of the open-weight Deepseek models. All the actors devised ways to allow their campaigns to run autonomously over relatively long periods of time.

“You can leverage different models for different aspects in the operation. Model routing and selection is very important because it’s expensive and a lot of times would be overkill to use newer models,” says Adam Meyers, CrowdStrike's senior vice president of counter adversary work. The researchers observed the attackers using both open- and closed-weight models; in almost all cases, they were using older versions rather than working with frontier models. Meyers notes that doing as much as possible with older models is common in legitimate AI usage, too, as costs mount.

The attackers also used multiple models to take advantage of differences in the guardrails meant to prevent people from using AI to carry out digital attacks.