Severity moderate: The campaigns hit many third parties across multiple countries, including at least 15 healthcare organizations in Argentina.
Earliest source we hold 2026-10-28 · Captured by AI Risk Wire 2026-10-28 12:43 UTC
CrowdStrike reported four previously unreported threat actors using agentic AI harnesses, including a dual-agent Claude Code setup on PentestGPT, to run intrusions against healthcare, government and SaaS targets across multiple countries.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
1 · What it was doingThreat actors used agentic AI harnesses, including a dual-agent Claude Code setup on PentestGPT, connected to external tools to run intrusions against healthcare, government and SaaS targets across multiple countries.
2 · What went wrongThe AI carried out reconnaissance, exploitation and data theft, and all four actors bypassed AI safety measures to compromise government and private-sector entities.
3 · What it reached or didAt least 15 healthcare organizations in Argentina were breached, with medical records and credentials stolen; targets also spanned government, SaaS and other private industries in multiple countries.
4 · How it was caughtCrowdStrike, an outside security vendor, identified the four previously unreported threat actors through its research and telemetry.
What the sources state
What set it off misused by a person
No source states: when it happened, when it was found, how many records were exposed, the direct loss, any court case, the cause, what was done.