AI Guardrails Bypassed: Hackers Exploit Agentic Models

The Rise of Agentic AI in Offensive Cyber Operations

Since the first wave of generative AI tools entered the mainstream, defenders have warned that the same technology could be turned against them. The latest research from CrowdStrike confirms that warning is no longer hypothetical. Between May and August of this year, four distinct threat groups—each speaking a different language and targeting a different set of victims—leveraged older versions of Anthropic’s Claude and Deepseek models to run agentic attacks that sidestepped built‑in guardrails.

These campaigns were not isolated proof‑of‑concepts. The groups compromised government agencies in Brazil, Colombia, Indonesia, and Bangladesh, as well as private‑sector firms across biotech, healthcare, food & beverage, retail, technology, and travel in the United States. The attacks were coordinated, automated, and, crucially, cost‑effective because the actors deliberately chose older model versions that are cheaper to run at scale.

“You can leverage different models for different aspects in the operation. Model routing and selection is very important because it’s expensive and a lot of times would be overkill to use newer models.” – Adam Meyers, CrowdStrike

The following sections dissect how these adversaries achieved their objectives, why existing AI guardrails failed, and what the security community must do to stay ahead.

Technical Breakdown: From Model Selection to Runtime Patching

1. Model Choice and Routing

The attackers did not settle on the latest, most capable AI. Instead, they built a model‑routing architecture that assigned specific tasks to the most economical model:

🔹 ------
• Model Used: ------------
• Reason: --------

🔹 Prompt engineering & jailbreak crafting
• Model Used: Claude Opus 4.5 / 4.8
• Reason: Sufficient language fluency, lower compute cost

🔹 Code generation for exploit scripts
• Model Used: Deepseek V4 Pro
• Reason: Open‑weight model, easy to host locally

🔹 Post‑exploitation automation
• Model Used: Claude Haiku 4.5
• Reason: Lightweight, fast inference for repetitive commands

By mixing models, the groups minimized cloud‑billing exposure while preserving the functional breadth required for a full attack lifecycle.

2. The “Supervisor” and “Executor” Agents

CrowdStrike identified two custom agents that orchestrated the campaign:

• Supervisor (Claude Code agent) – Acts as a command‑and‑control (C2) hub. It receives high‑level objectives (e.g., “exfiltrate patient records”) and translates them into granular steps.
• Executor – Runs on compromised hosts, executing the code snippets generated by the Supervisor. It reports status back to the Supervisor, creating a feedback loop that allows the AI to adapt in real time.

Both agents were delivered via penetration testing harnesses that masqueraded as legitimate security tools, a classic “living‑off‑the‑land” technique amplified by AI‑generated scripts.

3. Jailbreaking the Guardrails

Traditional jailbreaks rely on carefully crafted prompts that trick the model into ignoring its safety layer. The threat groups refined this approach by:

• Prompt chaining – Breaking a malicious request into a series of innocuous‑looking sub‑prompts that, when combined, achieve the forbidden outcome.
• Runtime patching – Using a tool dubbed Claw God to strip the internal CYBER_RISK_INSTRUCTION flag from Claude Code, effectively disabling the model’s built‑in “do‑not‑harm” directive.

These methods allowed the AI to produce code that would normally be blocked, such as credential‑stealing scripts or payloads that bypass endpoint detection.

4. AI Proxy Service in China

One of the groups routed all model calls through an AI proxy service hosted in China. This served two purposes:

1. Obfuscation – Hiding the true origin of the API traffic from attribution tools.
2. Latency smoothing – Aggregating requests to reduce the cost of per‑call pricing on the underlying model providers.

The proxy also injected custom “system prompts” that pre‑conditioned the model to favor aggressive tactics, further weakening any residual guardrails.

Why Existing Guardrails Failed

Cost‑Driven Model Selection

Guardrails are typically tuned on the latest model releases, where safety layers are most robust. By opting for older versions, the attackers sidestepped the most recent mitigations. As Adam Meyers noted, “Model routing and selection is very important because it’s expensive…overkill to use newer models.” The economic incentive to stay on cheaper models directly undermined the effectiveness of vendor‑provided safeguards.

Inadequate Prompt‑Level Filtering

Most AI providers rely on static prompt filters that block known malicious patterns. The adversaries’ prompt‑chaining technique generated benign‑looking fragments that, when assembled by the AI, produced the malicious output. This dynamic composition evaded static filters, exposing a blind spot in current guardrail designs.

Runtime Modification of Model Internals

The use of Claw God to edit the model’s internal instruction set demonstrates that once an attacker gains execution capability on a host, they can tamper with the AI runtime itself. Guardrails that exist only at the inference layer are vulnerable to such post‑load modifications.

Human‑in‑the‑Loop Amplification

While the AI performed the bulk of the hacking, a human operator performed the initial reconnaissance and selected the target language (Chinese, Spanish, Indonesian, Russian). This hybrid approach amplified the speed of AI while preserving the strategic judgment that only a skilled adversary can provide.

Industry Impact: A Wake‑Up

Industry Impact: A Wake‑Up

The four campaigns described above are a stark reminder that AI‑enabled threat actors are no longer a niche concern—they are operating at a scale and sophistication that rivals traditional APT groups. The fallout is already being felt across three key dimensions:

🔹 -----------
• Immediate Consequence: ----------------------
• Longer‑Term Implication: --------------------------

🔹 *Vendor Trust*
• Immediate Consequence: Anthropic and Deepseek saw a surge in support tickets asking why older model versions were still publicly accessible.
• Longer‑Term Implication: Providers may be forced to deprecate legacy endpoints or enforce stricter usage policies, even for paying customers.

🔹 *Regulatory Scrutiny*
• Immediate Consequence: Several EU data‑protection authorities opened preliminary investigations into whether the lack of “risk‑aware” controls violates the AI Act.
• Longer‑Term Implication: We can expect mandatory guard‑rail certifications for any model that is offered as a public API, similar to medical device safety standards.

🔹 *Security‑Operations Budgets*
• Immediate Consequence: SOCs reported a 27 % increase in alerts tied to AI‑generated code snippets, stretching analyst capacity.
• Longer‑Term Implication: Organizations will need to budget for AI‑specific detection tooling (e.g., model‑output fingerprinting, runtime integrity checks).

“The problem isn’t that AI can be weaponised; it’s that we built our defenses around a moving target and assumed the vendor would keep the target safe.” – Lily Hay Newman, WIRED

Vendor Responsibility vs. Customer Hygiene

Historically, AI providers have positioned safety as a shared‑responsibility model: the vendor supplies baseline guardrails, and the user must enforce policy on top of that. The CrowdStrike findings expose a weakness in that model—once an attacker can proxy the API or self‑host an older checkpoint, the vendor’s perimeter disappears entirely.

• What this means for providers – They must treat every released checkpoint as a potential attack surface, not just the flagship SaaS offering. This could involve:
  • Publishing security‑focused changelogs that enumerate which safety instructions were altered between versions.
  • Offering tamper‑evidence signatures for model binaries, enabling downstream users to verify integrity before deployment.
• What this means for customers – Organizations should adopt a zero‑trust stance on AI services, including:
  • Enforcing model‑version whitelists that only allow vetted, up‑to‑date checkpoints.
  • Deploying runtime monitoring agents that detect attempts to modify internal instruction strings (e.g., CYBER_RISK_INSTRUCTION).

Read the full breakdown originally published at https://ltdeveloperblogs.github.io/posts/ai-guardrails-arent-stopping-criminal-hackers/