CrowdStrike: Hackers Bypass AI Guardrails Using Claude — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- CrowdStrike researchers analyzed four previously unreported threat groups operating in Chinese, Spanish and English, Indonesian, and Russian between May and August, finding all had bypassed model safeguards and left their AI infrastructure openly accessible on web servers.
- Adam Meyers, CrowdStrike's senior vice president of counter adversary work, said the attackers used multiple models to exploit differences in guardrails, noting "the models don't all have equivalent guardrails and protections, even from one company," and relied largely on older model versions rather than frontier ones.
- The Spanish and English-speaking actor compromised at least 15 Argentine healthcare organizations, building a penetration testing harness with a "Supervisor" Claude Code agent directing an "Executor" agent, using Claude Opus 4.5, Claude Haiku 4.5, and Deepseek V4 Pro.
- The Chinese-speaking actor compromised government targets in Brazil and Colombia plus private organizations across biotech, healthcare, food and beverage, retail, technology, and travel, relying primarily on Claude Opus 4.8 and accessing Claude through a China-based AI proxy service with fallbacks to other models.
- The Chinese-speaking actor used a "run time patch" tool called ClawGod to strip the "CYBER_RISK_INSTRUCTION" directive from the Claude Code system prompt, while other groups convinced models their activity was authorized penetration testing by adding approval files to agent working directories or via prompt-level jailbreaks.
- Meyers characterized the attacks as relying on "the speed and the volume that you can use AI for" against preventable security hygiene issues rather than novel exploits, adding that humans still handle initial probing before AI scales the operation.
- Anthropic did not provide comment ahead of publication, and Deepseek did not immediately respond to WIRED's requests for comment.
Why it matters: At least 15 Argentine healthcare organizations plus government agencies in Brazil and Colombia were compromised in attacks where the guardrails frontier-model labs ship with were circumvented via older model versions, jailbreak prompts, and authorization-file tricks. The attackers won by exploiting volumes of basic, preventable security hygiene gaps rather than novel exploits, meaning defenders relying on model safety alone face an automated volume problem that old-school patching addresses.
Ask SkimNews
