On October 21, 2026, CrowdStrike published an investigation into four operators using AI agents to conduct intrusions. One operator compromised at least 15 healthcare entities based in Argentina. The report documents credentials and medical records taken from at least one victim; it does not establish that records were stolen from all 15.
For healthcare providers, technology suppliers and security teams in Latin America, the useful question is which paths an intruder could follow after obtaining an initial foothold. The documented sessions show agents continuing through obstacles, looking for credentials and finding routes between environments.
This article draws on the full CrowdStrike report and its public summary. The diagrams are Oktsec’s explanatory reconstructions. We have not independently investigated the victims’ systems.
What happened in Argentina
CrowdStrike describes Actor 1 by the languages used: Spanish and English. That is not verified nationality or location. The operator rebuilt an open-source penetration-testing framework, PentestGPT, around two Claude Code agents. One selected tasks; the other carried them out using connected tools.
The researchers reconstructed activity from tooling, prompts and outputs left in internet-accessible directories on the attackers’ infrastructure. This gives visibility into the operators’ workflow, but is not a complete account of each victim’s incident response or the ultimate impact on patients.
The campaign was observed between May and August 2026. October 21 is the publication date, not the date when all these intrusions began. The distinction matters when looking for historical evidence or communicating with leadership.
Two episodes that clarify the risk
In the first session, the operator started with existing access and asked the agent to move laterally and obtain credentials. Its first route was blocked. It found another path and obtained credentials from a domain controller, the infrastructure that manages authentication in a Windows domain. CrowdStrike describes this as approximately 20 minutes without further human guidance.
The second session involved two healthcare organizations that were already compromised. The agent used access to one to reach an internal server in the other, without an explicit instruction to make that pivot. The reported session lasted approximately 12.5 minutes. This was not a demonstration of compromising two previously secure organizations in that time.
Two episodes, measured in minutes
Both started from existing compromises. Neither measures the time needed to break in from scratch.
Inside one entity
≈ 20 minutes- Existing accessThe attacker was already inside.
- First attempt blockedFirewall or access controls.
- Alternative routeThe agent continues without further guidance.
- Credentials obtainedFrom the domain controller.
Across two entities
≈ 12.5 minutes- Entity A compromisedBoth entities had already been breached.
- A used as a bridgeThe agent chooses the route.
- Explores entity BFinds an internal path.
- Internal server reachedPlans the next step.
The full report documents both episodes on pages 13–14. Each illustrates a specific path from an existing foothold to a more sensitive system.
How the agent workflow operated
The Supervisor selected the next task from a state machine: a predefined workflow of attack stages. The Executor performed the task. The operator added MCP servers, Python scripts and skills to the PentestGPT-derived framework. A human still set the goal and could intervene.
How the two agents coordinated
Conceptual view of the PentestGPT-derived harness. Autonomy operated within a human-defined objective.
Task → execution → result → next task
This architecture matters because the software can evaluate a result and choose a subsequent action without waiting for a person to issue every command. A blocked attempt is therefore not evidence that the operation has stopped. Defenders need to understand what other credentials, network routes and tools remain available.
The presence of MCP or an open-source testing framework does not itself indicate malicious activity. Both have legitimate uses. In this case, the relevant distinction is the unauthorized access and the actions taken against victim systems.
CrowdStrike reports that all four operators overcame commercial AI safety controls. That is evidence about these observed campaigns, not proof that safeguards never work. For a team deploying its own agents, it is a reason to enforce permissions at the systems and tools being accessed, rather than treating the model’s acceptance of a request as authorization.
Keep the evidence and attribution separate
What we know, and its limits
An observation, a forecast and an unanswered question carry different evidentiary weight.
- Documented
- At least 15 entities compromised; credentials and medical records stolen from at least one. Both episodes appear in the PDF.
- Provider assessment
- Moderate confidence in the commoditization of offensive capabilities; high confidence that these intrusions will grow over the next 12 months.
- Separate attribution
- Brazil and Colombia appear in the report under Actor 2. They should not be added to Actor 1’s Argentine campaign.
- Not established
- Public identities of victims, patient count, notification status or the operator’s actual nationality.
The full PDF names Brazil and Colombia in its discussion of Actor 2. Those countries should not be attributed to the operator attacking Argentine healthcare simply because they appear in the same report. Similarly, a language, an infrastructure location and a person’s nationality are different forms of information.
CrowdStrike’s confidence statements describe analytical judgments about future adoption and offensive capabilities. Four investigated operators provide concrete examples; they do not measure the proportion of all attacks that use AI.
The report leaves important questions unanswered publicly: which entities were affected, how many patients’ records were involved and whether notifications occurred. Lack of a public notification in the material reviewed does not prove that victims or authorities were never informed.
What healthcare and infrastructure teams should check
The following checks are Oktsec recommendations derived from the observed behavior. They do not establish the root cause of every compromise in the report. Start with your own access paths, asset inventory and existing incident-response procedures.
From the episode to a concrete check
Oktsec recommendations for prioritizing a review. These are not a diagnosis of every affected organization.
Starts with existing access
Inventory, patching and removal of unnecessary access.
Continues when one route fails
Segmentation, permissions and outbound connections.
Obtains identity credentials
Administrative accounts, domain controllers and alerts.
Uses one entity as a bridge
Supplier access, trust boundaries and centralized logs.
Identity infrastructure and privileged accounts
Review who and what can reach domain controllers and other authentication services. Separate administrative identities from routine accounts, remove unnecessary privileges and validate alerts for unusual credential access. Confirm that service accounts have only the access their workloads need.
If compromise is suspected, coordinate credential rotation, session revocation and containment with incident response. A password change alone does not establish that an attacker’s access has been removed. Preserve relevant evidence and account for service dependencies before making disruptive changes.
Network and supplier access
Test whether one compromised application, supplier connection or remote-access account can reach systems outside its intended scope. Review routes between business units and organizations, including outbound connections. A firewall rule that blocks one technique does not demonstrate that every alternative path is controlled.
Ask suppliers to identify the systems and credentials they manage on your behalf, how access is restricted and how they would support an investigation. Record the contact responsible for escalation. Do not assume the cross-victim episode proves that a shared supplier was responsible; that causal claim is not established here.
Detection, evidence and response ownership
Confirm that authentication events, privileged actions and relevant network activity reach a central system that an intruder on one host cannot easily erase. Verify who receives alerts, who can revoke access and how an investigation starts outside normal working hours. Test the handoff with the team or provider already responsible for monitoring.
Each review should produce an owner, an evidence reference and an outstanding action. A completed checklist without a tested control provides little assurance. Existing SOC and response teams should receive these findings through their normal processes.
Patient data and notification decisions
Medical records can create consequences beyond a system outage. A healthcare organization needs to establish what information was accessed or removed, preserve the investigation record and prepare communications that distinguish confirmed impact from uncertainty.
Define the decision-makers before an incident: clinical operations, security, legal counsel, privacy and communications. Have counsel determine the duties that apply to the specific entity, sector, jurisdiction and contracts. Record the applicable notification criteria, recipients and deadlines in the response plan.
The public report’s lack of patient counts or named victims should not be filled with estimates. Communications to patients, authorities and partners should follow verified findings and the applicable requirements.
What this means for teams deploying their own AI agents
An agent environment can concentrate cloud credentials, repository tokens, model-provider keys and tool access. Inventory those identities, separate development and production permissions and examine what a compromised agent host could reach. This is a defensive implication of the case, not a claim that the Argentine victims were breached through their own AI deployments.
Test requests against explicit boundaries: the allowed tool, account, destination, resource and action. Keep untrusted documents, repository files and tool responses from becoming a substitute for authorization. Check alternate paths as well as the intended integration.
Oktsec can help scope a security assessment of those paths and review the controls with your team. Oktsec Control applies configured policy to agent traffic routed through it. It does not intercept an external attacker’s agents or protect routes that bypass it. Findings should feed into the organization’s existing security and incident-response processes.
Sources and editorial scope
- CrowdStrike: Uncovers New Agentic AI Campaigns, October 21, 2026. Public summary of the four operators.
- CrowdStrike: full Agentic AI Campaigns report. Pages 5–6: actor scope and architecture; pages 13–14: the two Argentine episodes; pages 17–18: confidence-qualified assessments.
Source review: October 25, 2026. Diagrams simplify the reported workflows for defensive analysis and omit operational exploitation instructions. Recommendations and product applicability are Oktsec analysis. This is an analysis of published research, not an independent incident investigation.