CrowdStrike Uncovers AI-Driven Cyberattackers Targeting Multiple Sectors

Cybersecurity firm CrowdStrike has revealed the emergence of four previously unreported threat actors utilizing agentic artificial intelligence to execute cyber intrusions. These AI agents are capable of handling reconnaissance, exploitation, and data theft with minimal human oversight, targeting sectors such as healthcare, government, and software-as-a-service providers across multiple countries.

According to CrowdStrike's October 2026 report, these actors, identified as Spanish/English, Chinese, Indonesian, and Russian-speaking groups, conducted their operations between mid-May and mid-August 2026. Notably, one actor leveraged a dual-agent Claude Code setup based on PentestGPT to breach at least 15 healthcare organizations in Argentina, compromising sensitive medical records and credentials.

The speed of these AI-driven attacks is alarming; in one instance, an AI agent completed lateral movement and domain credential harvesting in just 20 minutes without human guidance. CrowdStrike's telemetry indicates a threefold increase in agentic intrusions in the latter half of the year compared to the first half, highlighting a growing trend in AI-enabled adversary activity.

This rise in AI-driven cyber threats poses significant challenges for organizations, particularly in the healthcare sector, which is often underfunded and holds sensitive data. The report raises concerns about the effectiveness of current cybersecurity measures, as all four identified actors successfully bypassed AI safety protocols to execute their attacks.