Threat actors utilizing autonomous AI agent frameworks for offensive operations

CrowdStrike Counter Adversary Operations has identified four previously unreported threat actors deploying autonomous AI agent frameworks to conduct offensive cyber campaigns. These campaigns leverage AI agents to perform decision-making and command execution across the attack kill chain. Observed activities between May and August 2026 show threat actors customizing open-source projects, such as PentestGPT, to create modular, autonomous penetration testing harnesses. These agents operate with varying degrees of human intervention, utilizing frameworks to enumerate target environments, select exploitation methods, and exfiltrate data at machine speed.

Attack Chain

1. Infrastructure Preparation: Actors deploy purpose-built autonomous penetration testing harnesses, often integrating open-source frameworks (e.g., PentestGPT) with custom Python scripts and MCP servers.
2. Target Enumeration: AI agents are instructed to perform automated reconnaissance to map the target environment.
3. Task Selection: Agents (either single or dual-agent architectures) select attack stages from a predefined state machine or standard operating procedure.
4. Exploitation: AI agents identify and execute exploitation methods against identified vulnerabilities or targets.
5. Post-Exploitation: Agents carry out predefined post-execution workflows, including credential harvesting.
6. Data Exfiltration: Agents execute commands to exfiltrate sensitive data, such as medical records or corporate client information.

Impact

Documented impact includes successful compromises of at least 15 healthcare entities in Argentina, multiple government domains across various countries, and private-sector entities in the biotechnology, technology, and SaaS sectors. Data exfiltration has been confirmed in multiple instances, including credentials and medical records.

Recommendation

• Enhance Behavioral Monitoring: Focus on identifying automated, non-human-like patterns of activity, such as rapid sequential execution of reconnaissance and exploitation commands, which are characteristic of agentic AI frameworks.
• Restrict AI Tooling: Implement strict controls and visibility over the use of AI agent platforms and related proxies ("transfer stations") within the corporate environment to detect unauthorized use of AI-driven pentesting harnesses.
• Identity-Centric Defense: Given the actors' focus on credential exfiltration, implement and enforce robust multi-factor authentication (MFA) and continuous authorization for all access to sensitive internal data and SaaS environments.
• Threat Hunting: Hunt for unusual Python scripts or MCP (Model Context Protocol) server configurations in environments that might serve as staging areas for autonomous agents.