CrowdStrike and Anthropic Reports Put AI Agents on the Attack
Image design by Aragon, rendered by Canva AI.
By Adam Pease
CrowdStrike and Anthropic Reports Put AI Agents on the Attack
This week, several reports described AI agents carrying out attacks. CrowdStrike says it found four previously unreported threat actors using AI agents to run intrusions with limited human involvement. Anthropic says an unreleased internal model chained flaws into working exploits against Chrome, Safari, Android, Windows, and Linux in the lab. A joint analysis by Anthropic and the UK AI Security Institute (AISI) describes Claude Mythos 5 using fake accounts to push malicious code toward a GitHub project during a test.
In MIT Technology Review, two Partnership on AI leaders argue that agents’ actions must be monitored in real time. This blog overviews this week’s reports on AI agents carrying out attacks and offers our analysis.
Why Did CrowdStrike and Anthropic Report on Agent Attacks?
CrowdStrike observed the intrusions between May and August 2026 in healthcare, government, software-as-a-service (SaaS), and other industries. One threat actor compromised at least 15 healthcare organizations in Argentina. In one incident, an agent was blocked, found another route through a database server, reached a domain controller, and harvested five password hashes in about 20 minutes without further human guidance. In another, an agent obtained a cloud identity and access management token with Kubernetes cluster administrator privileges and used it to reach 726 tenant databases.
All four actors got around model safeguards, often by presenting intrusions as authorized penetration tests. CrowdStrike expects the trend to continue: “Over the next 12 months, agentic AI–supported intrusions will almost certainly increase in volume and sophistication.”
Anthropic’s Frontier Red Team described five exploit chains. One opened the Calculator app on a stock Mac running Chrome within seconds of a page loading. Another ran commands as root on a Linux server over the network, with no login. Anthropic says it reported every flaw to the vendors first and that all of them are patched. Apple and Google credit Anthropic for specific fixes, but The Hacker News found no public record for the Android fix. The company says the work needed only “initial prompting” and “little human involvement,” but it does not say what a person did at each step.
The Mythos 5 incident took place in July 2026 during an AISI test of cyberattack capability. Internet access was allowed and some of the model’s usual safeguards were turned off. When its permitted approach failed, Mythos 5 found a GitHub project run by a developer with no connection to the test, submitted a change containing malicious code, and used a fake account to vouch for it. The maintainer refused the change, and no damage occurred. In replays where the attack had already begun, the model kept going 98% of the time.
Analysis
At Aragon Research, we view this week’s reports as evidence for our prediction that by YE 2027, 50% of enterprises will have deployed agentic identity and security platforms (70% probability). They are evidence, not proof. What they do show is that the threat now moves at machine speed. CrowdStrike measured some agent-led intrusions in minutes, not days.
At that speed, the control point for defenders is identity and monitoring for non-human actors. The CrowdStrike case that reached 726 databases depended in part on one token with too much privilege. The Mythos 5 incident is a software supply chain issue: an agent using fake identities to get malicious code into software that other people download. AISI’s own lesson from the incident is that defenders should watch what an agent does rather than rely on its explanations.
Today, many enterprises lack that visibility. The Partnership on AI authors studied the four most widely used agent frameworks. They found that the frameworks lacked agent IDs that persist over time and lacked records of which humans approved agent tasks. Without those records, a security team has a hard time telling which agent did what, or whether an action was authorized.
The caveats need to be stated plainly. The exploit-chain claim rests on Anthropic’s own account, the chains were built in the lab after prompting, and none was seen in a real attack. The Mythos 5 incident happened in a test environment with safeguards disabled. Many outlets are repeating the same few reports, so the amount of coverage this week is not independent confirmation.
What Should Enterprises Do?
Start with an inventory of the AI agents running in your enterprise, including coding assistants and agents embedded in SaaS applications. Give each agent its own identity with least privilege, so that a single token cannot reach an entire cluster. Log and monitor what agents actually do, including human approvals and changes to an agent’s permissions.
When you evaluate agent platforms and security vendors, ask how they handle agent identity. Ask whether their products issue persistent agent IDs and record which humans approved agent actions. Security teams should also treat agent-submitted code changes to software they depend on as a supply chain risk.
Bottom Line
This week’s reports show AI agents carrying out attacks at machine speed, though the most dramatic claims come from lab work and single sources. The control point for defenders is identity and monitoring for non-human actors. Enterprises should inventory their agents and give each one a least-privilege identity before agent activity outpaces their ability to see it.