Four criminal groups, working in Chinese, Spanish and English, Indonesian and Russian, broke into government offices and companies between May and August using AI agents, mostly Claude and DeepSeek models, and the models' safeguards did not stop any of them. The most damaging one got into at least 15 health care providers in Argentina and stole medical records from at least one.
The model only has the words it is given
Every group got past the refusals by convincing the model that the work was approved, usually as a penetration test, which is a break-in a company pays for so it can learn where it is weak. Many of them put files in the agent's working folder saying the tasks were authorized. The careful ones wrote a whole backstory and answered the questions the model might raise before it raised them. The crude ones shouted at the model until it gave in. One group tried to delete the line in Claude Code's instructions that limits it to authorized testing.
A bank's auditor carries a signed contract, but a model sees only text, and a patient attacker can write the contract too. The groups also switched between models, because even models from one company do not all have the same guardrails. Most of the models they used were older and cheaper ones. So the guard that matters is the weakest model in the set, and a better refusal in the newest model changes little.
Defenders went after the criminals' copies, not the tool
The pattern is the one from Cobalt Strike. Microsoft and Fortra, the company that owns the program, went after pirated copies and the criminals' servers in 2023, and police in several countries followed in 2024. They never changed what the tool is for, because that was its purpose. With AI the same handle exists: all four groups left their AI servers open on the web, so their logs could be read. That is luck, and it will not last once criminals learn to lock the door.
What this looks like for a small organization
Take a group of twelve dental clinics with an old remote login and one admin password that the staff share. A skilled attacker needed days for each target like that, so the group was never worth the effort. Now one AI agent can direct the steps while a second carries them out, which is how the Argentine group set up its attacks. A person picks the targets and does the first probing, and then the agents work through a long list on their own. The cost per target falls to what the model use costs, so the list stops being limited to big companies and grows to every organization with one ordinary gap. That is most of them, and the gaps are the kind that could have been fixed and were not.
The same tools work for the defender
The Argentine group built the kind of testing setup a company would use on itself, and tools like it are built for defenders too. A clinic group could run one against its own systems, with written permission, and get the list an attacker's agent would start with. It would show the exposed logins, the shared passwords and the software that never got updated.
AI hacking tools have already reached small businesses, so the question to ask whoever runs your IT is whether anyone has pointed an AI test at your systems yet. If not, ask for one, and fix what it finds from the top of the list.