Hackers Are Jailbreaking Claude and DeepSeek to Automate Real Attacks

Cybercriminals don't need cutting-edge AI to pull off a successful attack. They just need to talk their way past the guardrails of whatever model they can get their hands on.

That's the core finding in new research from CrowdStrike, published Wednesday, detailing four previously unreported hacking groups that built AI-driven attack infrastructure between May and August. Two of the groups showed real technical sophistication. Two were comparatively crude. All four managed to compromise real targets, and all four found ways around the safety restrictions that AI companies build into their models specifically to prevent this kind of misuse.

The groups operated in Chinese, in Spanish and English, in Indonesian, and in Russian, according to CrowdStrike. Each left its AI infrastructure exposed on open web servers, which is how researchers were able to reconstruct what happened. The models of choice were largely older versions of Anthropic's Claude and the open-weight DeepSeek models, not the newest, most capable releases.

Old models, new tricks

That choice of older AI models isn't a sign these attackers were working with scraps. It's a cost calculation, and it's one legitimate businesses make too.

"You can leverage different models for different aspects in the operation. Model routing and selection is very important because it's expensive and a lot of times would be overkill to use newer models," Adam Meyers, CrowdStrike's senior vice president of counter adversary work, told Wired.

The attackers also mixed and matched models specifically to exploit inconsistencies in how well-guarded each one is. As Meyers put it, "the models don't all have equivalent guardrails and protections, even from one company." If one model balked at a request, there was often another, less restrictive one to fall back on.

What's notably absent from this wave of attacks: novel exploits or zero-day vulnerabilities. Meyers was blunt about it. "These attacks are not using new exploits or novel vulnerabilities," he said. "They're really just taking advantage of the speed and the volume that you can use AI for in conducting these operations targeting the bulk of security hygiene issues in a lot of these environments — things that were preventable but weren't prevented." In other words, AI isn't handing criminals new weapons. It's letting them fire the old ones faster and at a much larger scale, against defenses that were already inadequate.

Convincing the AI it's the good guy

The real breakthrough for these groups wasn't technical. It was social engineering aimed at the model itself.

CrowdStrike found that all four actors got around safety restrictions largely by convincing the AI that their activity was authorized, often by framing it as legitimate penetration testing or a security evaluation. One common tactic involved planting files in an AI agent's working directory to create the appearance that a task had already been approved. Beyond that, attackers used classic jailbreaking approaches: building an elaborate, plausible narrative around why the hacking was sanctioned, and getting ahead of any objections the model might raise before it could raise them.

The more sophisticated groups tended to be patient and strategic about this fiction-building. The less sophisticated ones were cruder, sometimes simply hammering the model with aggressive prompts until it accepted the premise that the activity was fine.

One group, the Chinese-speaking actor, went a step further with a tool called ClawGod, a "run time patch" that added capabilities on top of Claude Code and attempted to strip out a specific line in its system prompt known as "CYBER_RISK_INSTRUCTION" — the instruction meant to confine Claude Code to authorized security work rather than genuine attacks.

The attacks that actually landed

This wasn't theoretical. CrowdStrike tied each group to confirmed compromises.

The Spanish- and English-speaking actor went after health care organizations in Argentina and successfully breached at least 15 of them, according to the researchers, with evidence that credentials and medical records were stolen from at least one victim. That group built a custom penetration-testing harness and ran a two-tier autonomous system: a "Supervisor" Claude Code agent directing strategy, and an "Executor" agent carrying out the actual steps, using a mix of Claude Opus 4.5, Claude Haiku 4.5, and DeepSeek V4 Pro.

The Chinese-speaking actor built its own penetration-testing harness to have Claude Code handle reconnaissance, then let the system attack autonomously once a human picked a target or approach. CrowdStrike says this group compromised government targets in Brazil and Colombia, and hit private organizations in Brazil and the US across biotech, health care, food and beverage, retail, technology, and travel. It relied primarily on Claude Opus 4.8, supplemented by Claude Sonnet 4.6 and DeepSeek Chat, routed through a China-based AI proxy service with backup tools ready in case Claude became unavailable.

The Russian-speaking actor appeared to be running a financially motivated "e-crime" operation, while the Indonesian-speaking group was the least sophisticated of the four, relying on basic, publicly available tools and harnesses. Even so, both succeeded: the Indonesian-speaking actor compromised multiple Indonesian government domains, a Bangladeshi government domain, and several private-sector targets.

Anthropic did not comment ahead of Wired's publication, and DeepSeek did not immediately respond to a request for comment.

The human is still in the loop

For all the autonomy built into these systems, CrowdStrike's research points to a persistent human fingerprint behind the machinery.

"What we are seeing is humans are doing some of the initial probing in these situations and then they're engaging the AI for the hacking at scale," Meyers said. "I find it interesting that even with agentic attacks with all of these capabilities, we could still see that there's a human behind it and what they're up to."

That's arguably the most useful takeaway here for defenders. The threat isn't an AI acting on its own initiative, it's a person who has figured out how to get an AI to do the repetitive, high-volume parts of an attack it would otherwise take a team to execute. The guardrails meant to stop that handoff are, for now, proving easy enough to talk around, whether through a fabricated pen-testing narrative or a tool that simply edits the restriction out of the model's instructions. As AI adoption grows on both sides of the fight, the gap between a model's stated safety limits and what a determined attacker can actually get it to do is shaping up to be one of the industry's more pressing problems.