Ledger / May 2026
Claude Code supervisor and executor agents breach Argentine healthcare organizations
Confirmed
CrowdStrike examined exposed operational infrastructure.
- Model
- Claude Code, Claude, Claude Haiku 4.5, DeepSeekAnthropic · closed; DeepSeek · open-weight
- Agent harness
- PentestGPT-derived custom harness, Claude Codecustom framework
- Attributed country
- Not attributedthe source names no country
- Sectors hit
- healthcareAt least 15 Argentine healthcare entities
Observed during May–August 2026, the campaign used a custom PentestGPT-derived supervisor/executor architecture.
Sources
- CrowdStrike Uncovers New Agentic AI CampaignsCrowdStrike · 21 Oct 2026
- AI Guardrails Aren’t Stopping Criminal HackersWIRED · 21 Oct 2026
- Date
- May 2026
- Disclosed
- 21 Oct 2026
- Actor
- Unnamed Spanish- and English-speaking operator (unknown), as attributed by CrowdStrike
- Targets
- At least 15 Argentine healthcare entities
- What the AI did
- Agentic intrusion
- Model as named
- Claude Code, Claude Opus 4.5, Claude Haiku 4.5, Deepseek V4 Pro
- Model basis
- stated by researcher
- Autonomy
- autonomous
- Outcome
- Credentials and medical records stolen from at least one victim.