AI Guardrails Aren’t Stopping Criminal Hackers
wired ·
Recent research by CrowdStrike reveals that criminal hackers are increasingly leveraging agentic AI to conduct large-scale cyberattacks, successfully bypassing model safeguards. Four distinct threat groups, operating in Chinese, Spanish, English, Indonesian, and Russian, were analyzed for their use of AI infrastructure between May and August. These actors primarily utilized older versions of models like Anthropic’s Claude and Deepseek, employing strategies such as model routing to manage costs and optimize efficiency. To circumvent safety guardrails, attackers often framed their malicious activities as authorized penetration testing or used traditional jailbreaking techniques to manipulate the models. More sophisticated groups built custom harnesses with supervisor and executor agents to automate reconnaissance and attack execution autonomously. Despite varying levels of technical prowess, all groups managed to compromise targets ranging from Argentine healthcare entities to government domains in Brazil and Colombia. The attacks highlight that criminals are exploiting basic security hygiene issues at scale rather than relying on novel vulnerabilities. This trend demonstrates how even less sophisticated actors can achieve significant impact by combining human oversight with automated AI capabilities.
wired