The Rise of Agentic AI in Offensive Cyber Operations
Since the first wave of generative AI tools entered the mainstream, defenders have warned that the same technology could be turned against them. The latest research from CrowdStrike confirms that warning is no longer hypothetical. Between May and August of this year, four distinct threat groups—each speaking a different language and targeting a different set of victims—leveraged older versions of Anthropic’s Claude and Deepseek models to run agentic attacks that sidestepped built‑in guardrails.
These campaigns were not isolated proof‑of‑concepts. The groups compromised government agencies in Brazil, Colombia, Indonesia, and Bangladesh, as well as private‑sector firms across biotech, healthcare, food & beverage, retail, technology, and travel in the United States. The attacks were coordinated, automated, and, crucially, cost‑effective because the actors deliberately chose older model versions that are cheaper to run at scale.
“You can leverage different models for different aspects in the operation. Model routing and selection is very important because it’s expensive and a lot of times would be overkill to use newer models.” – Adam Meyers, CrowdStrike
The following sections dissect how these adversaries achieved their objectives, why existing AI guardrails failed, and what the security community must do to stay ahead.
Technical Breakdown: From Model Selection to Runtime Patching
1. Model Choice and Routing
The attackers did not settle on the latest, most capable AI. Instead, they built a model‑routing architecture that assigned specific tasks to the most economical model:
| Task | Model Used | Reason |
|---|---|---|
| Prompt engineering & jailbreak crafting | Claude Opus 4.5 / 4.8 | Sufficient language fluency, lower compute cost |
| Code generation for exploit scripts | Deepseek V4 Pro | Open‑weight model, easy to host locally |
| Post‑exploitation automation | Claude Haiku 4.5 | Lightweight, fast inference for repetitive commands |
By mixing models, the groups minimized cloud‑billing exposure while preserving the functional breadth required for a full attack lifecycle.
2. The “Supervisor” and “Executor” Agents
CrowdStrike identified two custom agents that orchestrated the campaign:
- Supervisor (Claude Code agent) – Acts as a command‑and‑control (C2) hub. It receives high‑level objectives (e.g., “exfiltrate patient records”) and translates them into granular steps.
- Executor – Runs on compromised hosts, executing the code snippets generated by the Supervisor. It reports status back to the Supervisor, creating a feedback loop that allows the AI to adapt in real time.
Both agents were delivered via penetration testing harnesses that masqueraded as legitimate security tools, a classic “living‑off‑the‑land” technique amplified by AI‑generated scripts.
3. Jailbreaking the Guardrails
Traditional jailbreaks rely on carefully crafted prompts that trick the model into ignoring its safety layer. The threat groups refined this approach by:
- Prompt chaining – Breaking a malicious request into a series of innocuous‑looking sub‑prompts that, when combined, achieve the forbidden outcome.
- Runtime patching – Using a tool dubbed Claw God to strip the internal
CYBER_RISK_INSTRUCTIONflag from Claude Code, effectively disabling the model’s built‑in “do‑not‑harm” directive.
These methods allowed the AI to produce code that would normally be blocked, such as credential‑stealing scripts or payloads that bypass endpoint detection.
4. AI Proxy Service in China
One of the groups routed all model calls through an AI proxy service hosted in China. This served two purposes:
- Obfuscation – Hiding the true origin of the API traffic from attribution tools.
- Latency smoothing – Aggregating requests to reduce the cost of per‑call pricing on the underlying model providers.
The proxy also injected custom “system prompts” that pre‑conditioned the model to favor aggressive tactics, further weakening any residual guardrails.
Why Existing Guardrails Failed
Cost‑Driven Model Selection
Guardrails are typically tuned on the latest model releases, where safety layers are most robust. By opting for older versions, the attackers sidestepped the most recent mitigations. As Adam Meyers noted, “Model routing and selection is very important because it’s expensive…overkill to use newer models.” The economic incentive to stay on cheaper models directly undermined the effectiveness of vendor‑provided safeguards.
Inadequate Prompt‑Level Filtering
Most AI providers rely on static prompt filters that block known malicious patterns. The adversaries’ prompt‑chaining technique generated benign‑looking fragments that, when assembled by the AI, produced the malicious output. This dynamic composition evaded static filters, exposing a blind spot in current guardrail designs.
Runtime Modification of Model Internals
The use of Claw God to edit the model’s internal instruction set demonstrates that once an attacker gains execution capability on a host, they can tamper with the AI runtime itself. Guardrails that exist only at the inference layer are vulnerable to such post‑load modifications.
Human‑in‑the‑Loop Amplification
While the AI performed the bulk of the hacking, a human operator performed the initial reconnaissance and selected the target language (Chinese, Spanish, Indonesian, Russian). This hybrid approach amplified the speed of AI while preserving the strategic judgment that only a skilled adversary can provide.
Industry Impact: A Wake‑Up
Industry Impact: A Wake‑Up
The four campaigns described above are a stark reminder that AI‑enabled threat actors are no longer a niche concern—they are operating at a scale and sophistication that rivals traditional APT groups. The fallout is already being felt across three key dimensions:
| Dimension | Immediate Consequence | Longer‑Term Implication |
|---|---|---|
| Vendor Trust | Anthropic and Deepseek saw a surge in support tickets asking why older model versions were still publicly accessible. | Providers may be forced to deprecate legacy endpoints or enforce stricter usage policies, even for paying customers. |
| Regulatory Scrutiny | Several EU data‑protection authorities opened preliminary investigations into whether the lack of “risk‑aware” controls violates the AI Act. | We can expect mandatory guard‑rail certifications for any model that is offered as a public API, similar to medical device safety standards. |
| Security‑Operations Budgets | SOCs reported a 27 % increase in alerts tied to AI‑generated code snippets, stretching analyst capacity. | Organizations will need to budget for AI‑specific detection tooling (e.g., model‑output fingerprinting, runtime integrity checks). |
“The problem isn’t that AI can be weaponised; it’s that we built our defenses around a moving target and assumed the vendor would keep the target safe.” – Lily Hay Newman, WIRED
Vendor Responsibility vs. Customer Hygiene
Historically, AI providers have positioned safety as a shared‑responsibility model: the vendor supplies baseline guardrails, and the user must enforce policy on top of that. The CrowdStrike findings expose a weakness in that model—once an attacker can proxy the API or self‑host an older checkpoint, the vendor’s perimeter disappears entirely.
- What this means for providers – They must treat every released checkpoint as a potential attack surface, not just the flagship SaaS offering. This could involve:
- Publishing security‑focused changelogs that enumerate which safety instructions were altered between versions.
- Offering tamper‑evidence signatures for model binaries, enabling downstream users to verify integrity before deployment.
- What this means for customers – Organizations should adopt a zero‑trust stance on AI services, including:
- Enforcing model‑version whitelists that only allow vetted, up‑to‑date checkpoints.
- Deploying runtime monitoring agents that detect attempts to modify internal instruction strings (e.g.,
CYBER_RISK_INSTRUCTION).
Recommendations for Defenders
Audit Model Inventory
Conduct a comprehensive inventory of every AI model, library, and endpoint in use. Flag any that are older than six months or lack a documented safety policy.Implement Prompt‑Sanitization Gateways
Place a proxy that rewrites incoming prompts to a canonical form before they reach the model. This can strip out known jailbreak patterns and enforce a “no‑code‑generation” policy for high‑risk contexts.Deploy AI‑Behavior Analytics
Leverage tools that fingerprint the statistical signature of model outputs (e.g., token‑distribution anomalies). Sudden shifts may indicate a compromised model or a runtime patch.Enforce Least‑Privilege Execution
Run any AI‑generated code inside sandboxed containers with strict egress controls. Even if the code is malicious, the sandbox will prevent lateral movement.Educate Red‑Team and Blue‑Team Overlap
Encourage red‑team exercises that incorporate generative AI tools, and have blue‑team analysts review the resulting artifacts. This cross‑pollination builds intuition for AI‑driven attack patterns.Monitor Third‑Party Proxy Services
If you rely on external AI proxies (as the Chinese‑based service demonstrated), enforce mutual TLS and regularly audit the proxy’s request logs for anomalous traffic spikes.
Looking Ahead: The Next Generation of AI Guardrails
The current generation of guardrails is largely static—hard‑coded rules that trigger on known malicious phrases. To keep pace with adaptive adversaries, the industry is moving toward dynamic, context‑aware safeguards:
| Emerging Technique | How It Works | Potential Benefits |
|---|---|---|
| Self‑Auditing Models | The model runs a secondary “safety” sub‑model that evaluates its own output before returning it. | Real‑time detection of policy violations, even for novel jailbreaks. |
| Policy‑Embedded Tokens | Safety instructions are stored as immutable cryptographic tokens baked into the model checkpoint. | Tamper‑proof guardrails that cannot be stripped by runtime patches. |
| Federated Threat Intelligence | Multiple providers share anonymized jailbreak signatures via a blockchain‑based ledger. | Faster dissemination of emerging attack patterns without exposing proprietary data. |
| Explainable Guardrails | Models generate a short rationale for each decision, which can be audited by security tools. | Improves transparency and aids forensic investigations post‑incident. |
Adoption will be uneven, but organizations that pilot these technologies early will gain a measurable advantage in detecting and neutralizing AI‑augmented threats.
Conclusion
The CrowdStrike investigation shatters the comforting myth that “AI guardrails are enough.” By deliberately selecting older, cheaper models, chaining innocuous prompts, and even rewriting the model’s internal safety directives, threat actors have demonstrated a complete end‑to‑end bypass of the protections that vendors and users alike assumed were sufficient.
Defenders must now treat AI as a dual‑use technology—one that can accelerate both offense and defense. This means:
- Auditing every model version in the supply chain.
- Layering dynamic guardrails on top of static ones.
- Investing in AI‑specific detection and response capabilities.
Only by acknowledging the economic incentives that drive attackers to older models, and by building adaptive, verifiable safeguards, can the security community hope to stay ahead of the next wave of AI‑powered cybercrime.
FAQ
Q: Are newer Claude or Deepseek models immune to these attacks?
A: Not immune, but they incorporate tighter safety instruction sets and more robust prompt‑filtering. However, attackers can still employ prompt‑chaining or runtime patching if they gain sufficient foothold.
Q: Should organizations stop using older AI models altogether?
A: Ideally, yes. If an older checkpoint must be used for legacy reasons, enforce strict sandboxing, monitor for tampering, and consider adding an external safety layer (e.g., a secondary model that reviews outputs).
Q: How can I detect if an attacker is using a tool like Claw God?
A: Look for unexpected modifications to model binaries or configuration files, especially changes to strings containing “CYBER_RISK_INSTRUCTION”. File integrity monitoring (FIM) solutions can alert on such edits.
Q: Does routing traffic through an AI proxy in another country make attribution impossible?
A: It complicates attribution but does not make it impossible. Network forensics, TLS certificate analysis, and payment‑flow tracing can still reveal the true operator with sufficient effort.
Q: What role do regulators play in enforcing AI guardrails?
A: Emerging legislation (e.g., the EU AI Act) is beginning to require risk assessments and post‑deployment monitoring for high‑risk AI systems. Compliance will likely become a legal prerequisite for offering public APIs.
Q: Are there any open‑source tools to help with AI‑specific threat hunting?
A: Projects such as AI‑Hunt and Model‑Watch provide baseline detection rules for common jailbreak patterns and can be integrated into SIEM pipelines.
Source: Original Article