---
type: "post"
id: "crowdstrike-uncovers-new-agentic-ai-campaigns-621213"
slug: "crowdstrike-uncovers-new-agentic-ai-campaigns-621213"
title: "CrowdStrike Uncovers New Agentic AI Campaigns"
description: "CrowdStrike said its Counter Adversary Operations team identified four previously unreported threat actors using AI agents in campaigns between May and August 2026."
retrieval_nugget: "CrowdStrike said its Counter Adversary Operations team identified four previously unreported threat actors using AI agents in campaigns between May and August 2026."
published_at: "2026-10-22"
updated_at: "2026-10-22"
record_date: "2026-10-22"
date_kind: "published_at"
topics: []
entities: ["CrowdStrike","Claude Code","PentestGPT","Model Context Protocol"]
related_patterns: ["agent-security-moves-to-runtime-boundaries","harness-architecture-outlives-model-choice"]
novelty_label: "new_fact"
what_changed: "CrowdStrike reports new agentic-AI campaigns, adding a fresh finding to the archive’s prior account of autonomous AI cyberattacks."
prior_refs: ["memory:f1266828-c3a8-83b9-ab5b-1ee9a620e39b"]
source_url: "https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns"
source_urls: ["https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:crowdstrike-uncovers-new-agentic-ai-campaigns-621213"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/crowdstrike-uncovers-new-agentic-ai-campaigns-621213/","markdown":"https://newruntime.com/posts/crowdstrike-uncovers-new-agentic-ai-campaigns-621213.md","json":"https://newruntime.com/posts/crowdstrike-uncovers-new-agentic-ai-campaigns-621213.json"}
---

# CrowdStrike Uncovers New Agentic AI Campaigns

## Retrieval answer

CrowdStrike said its Counter Adversary Operations team identified four previously unreported threat actors using AI agents in campaigns between May and August 2026.

CrowdStrike said its Counter Adversary Operations team identified four previously unreported threat actors using AI agents in campaigns between May and August 2026. According to the company, the agents made decisions and executed commands rather than only producing tools or other artifacts. The operators exposed offensive agent frameworks through open directories.

One Spanish- and English-speaking operator allegedly compromised at least 15 healthcare entities in Argentina. CrowdStrike said credentials and medical records were exfiltrated from at least one victim. The operator used a dual-agent penetration-testing harness: a Claude Code “Supervisor” selected the next state-machine task, while an “Executor” performed it.

CrowdStrike described the framework as derived from the open-source PentestGPT project and modified with MCP servers, Python exploitation scripts, and skills. The report does not establish that these four actors were coordinated, that they explain a wider set of recent security incidents, or that AI operated without human direction.

Source: https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)