Four Threat Groups Use Claude and DeepSeek Models to Run Agentic Intrusions Against Government and Health Targets
Review INC-RW-0016
An AI agent executed most of the operation.
Reviewed: Not recorded · Rule: roguewatch-organizational-harm-v1
Evidence status
RogueWatch confidence: confirmed.
Dates and discovery
- Incident date
- 2026-10-21
- Added to research / record
- Posted to RogueWatch
- No linked public incident
- First observed
- Not recorded
- Discovery channel
- Not recorded
Related incident records: RW-0016
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- AI Guardrails Aren’t Stopping Criminal HackersRelationship not established · www.wired.com · Published 2026-10-21
- CrowdStrike identifies AI agents conducting autonomous cyberattacksRelationship not established · cryptobriefing.com · Published 2026-10-27
- Agentic AI helps hackers level up, even without detailed instructionsRelationship not established · tech.yahoo.com · Published 2026-10-22
Decision history
- · Incident record added
RW-0016. Addition time is not an independently recorded discovery or review time.
Evidence source · Evidence source · Evidence source - · Incident correction
confidence: reported → confirmed. Corroborated by an additional independent source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.