CrowdStrike Says Hackers Ran Claude Code Through Real Break-Ins. One Took 20 Minutes

CrowdStrike says an agent moved through a company's network and harvested domain controller credentials in about 20 minutes, without additional human guidance. In a blog post on Oct 21, 2026, CrowdStrike Counter Adversary Operations says four previously unreported hacking groups ran Anthropic's Claude Code as the engine of their intrusion campaigns between May and August 2026, and that all four got past commercial AI safety controls. CrowdStrike found them because each group left its attack setup exposed in an open directory on the internet.