The interesting failure mode here is operational hygiene. Four intrusion teams built Claude Code harnesses potent enough for live campaigns, then left the directories open.
On 21 October 2026, CrowdStrike's Counter Adversary Operations team posted "CrowdStrike Uncovers New Agentic AI Campaigns." The public blog summarises four previously unreported actors observed between May and August 2026. In each case AI agents made decisions and executed commands, rather than only drafting malware offline.
Open directories turned private agent frameworks into public case studies
CrowdStrike Intelligence and OverWatch had already been tracking AI-assisted tooling. This report narrows to agentic campaigns: stateful workflows where a coding agent selects the next intrusion step and runs it. The documentary accident is that each actor exposed enough of the harness directory for Counter Adversary Operations to reconstruct architecture, skills, and operating procedure without needing a courtroom exhibit list in the public post.
That places the piece beside Microsoft's Storm-0940 / ARTEX write-up on ConnectWise without duplicating it. Storm-0940 is a named intrusion set on a multi-tenant backup path. CrowdStrike's four cases are a survey of how different skill levels wire Claude Code, MCP servers, and skills into offensive loops.
Four harnesses: dual-agent healthcare, proxy specialists, skill pile, slash-command SaaS
Threat Actor 1 speaks Spanish and English and, on CrowdStrike's count, compromised at least fifteen Argentina-based healthcare entities, with credentials and medical records exfiltrated from at least one victim. The harness is a purpose-built autonomous pentest stack derived from open-source PentestGPT. A Supervisor Claude Code agent picks the next task from a state machine of attack stages; an Executor agent performs it. The rebuild adds MCP servers, Python exploitation scripts, and skills.
Threat Actor 2 is Chinese-speaking, with more than twenty named global targets. CrowdStrike says the actor compromised government entities of two countries and targeted private-sector organisations in Brazil and the United States across biotech, healthcare, food and beverage, retail, technology, and travel.
Access to Claude models ran through a China-based AI proxy ("transfer station"). One harness deterministically runs reconnaissance, then asks a model to choose among pre-set actions routed to agents. Another gives Claude Code more autonomy as a single agent under a standard operating procedure, or as a coordinator of specialist agents in parallel.
Threat Actor 3 is Indonesian-speaking and, in CrowdStrike's ranking, the least sophisticated of the four. The operator loads 819 skills, overwhelmingly from public GitHub repositories (CrowdStrike cites claude-red among sources), and instructs Claude Code to compromise a target with little extra orchestration. Periodic human intervention appears when safety guardrails fire or a barrier needs another push. Even so, CrowdStrike ties the actor to several Indonesian government domains, a government domain of another country, and several private-sector entities.
Threat Actor 4 is a Russian-speaking group. CrowdStrike reports exfiltration of corporate client data from a U.S.-based CRM vendor, plus compromises of private-sector SaaS and data-centre entities in Russia, Kyrgyzstan, and the United States, and one foreign government domain. A single /pentest-setup slash command tasks Claude Code with a seven-step workflow: enumerate, choose exploitation methods with near-total autonomy, follow a high-level post-RCE path, and execute explicit exfiltration instructions.
CrowdStrike publishes the four cases and points defenders at rising volume
The public change on 21 October is the disclosure itself: named architectural patterns, victim-sector sketches, and an assessment that agentic AI-supported intrusions will almost certainly increase in volume and sophistication over the next year. CrowdStrike also expects low-skill actors to reach effectiveness previously associated with organised crime or state-nexus groups, and expects some actors to harden operational security around these harnesses.
The full report is offered as a download from the blog post. Frontier is working from the public summary, not from a claimed independent copy of each open directory.
Treat frontier coding agents with MCP and skills as intrusion-capable runtimes
For defenders, the operational rule is blunt. Claude Code-class agents with MCP servers, skill packs, and shell reach are already inside real intrusion campaigns. Detection and response should assume Supervisor/Executor patterns, slash-command playbooks, and large public skill piles alongside handwritten implants. Exposed offensive directories are both an intelligence gift and a reminder that actors still misconfigure the same cloud storage they use to accelerate operations.
Open directories prove tooling; they do not settle every victim count in the blog
CrowdStrike's public post is secondary to the underlying directories and telemetry the firm holds. Frontier is not treating the blog's victim tallies, confidence language, or twelve-month forecasts as independently audited. The four architectural descriptions are the part of the record strongest for citation: dual-agent state machine, proxy-plus-specialists, skill-pile operator, slash-command seven-step workflow.
Full directory hashes, MCP inventories, and cross-correlation with Storm-0940 remain closed
The public blog does not publish file hashes for the open directories, full MCP server inventories, or a detailed overlap analysis with Microsoft's ARTEX-centred ConnectWise case. Timing of when each directory was exposed and closed is also thin in the summary. Until those land in a primary artifact Frontier can cite, treat the four harness patterns as established and the broader volume forecast as CrowdStrike's assessment.