Agent-enabled intrusions have operators, infrastructure and different levels of autonomy

CrowdStrike reported four intrusion operators using Claude Code in materially different ways. One paired a supervising agent with an executor; another maintained two alternative harnesses; a third supplied hundreds of offensive skills; and a fourth used a seven-stage workflow. Their common dependency on coding agents does not make them one campaign, nor does it show that models independently selected all their victims.

The four operator profiles come from one CrowdStrike investigation. They identify different observable control structures. A model making a tool choice in a scripted stage is not equivalent to a model planning the campaign from target selection through monetization. The evidence supports operational acceleration and partial delegation; it does not establish fully self-directed criminal organizations.

Microsoft's Storm-0940 account ties ARTEX activity to stolen ConnectWise application credentials and access attempts across more than 2,250 Microsoft 365 customer tenants. That number measures attempted tenant reach, not 2,250 successfully breached customers. Microsoft's separate October 10 to 14 spray produced more than 151,000 failed sign-ins to 327 accounts without success in that sampled campaign. Combining those populations would manufacture a larger victim count and erase the separate access paths. Its observed persistence in some downstream tenants must be distinguished from broad initial targeting.

VULONE's recovered Cairn infrastructure offers another evidence type: operator-side project records. The exposed panel listed 66 active projects with recorded access in 48, subdivided into root/SYSTEM, lesser command execution and webshell outcomes. These are not 48 independently confirmed victim organizations. VULONE's specific SMTP-gateway investigation also describes 118 exfiltration events at one named target; event count is not victim count. Reporting elsewhere on Cairn may cover overlapping tooling, so totals must not automatically be added.

Finally, Sekoia's Flowise honeypot establishes that an actor probed APIs, collected decoy credentials and submitted offensive prompts. The emulator never ran a live model or shell. It is evidence of attacker intent and attempted orchestration abuse, not proof an AI agent complied and compromised a real service.

An account of AI-assisted intrusion should identify the human command, agent/harness capability, underlying credential or software trust boundary, and observed outcome. The same evidence might establish only attempted probing in one case and confirmed exfiltration in another. Preserving those differences gives operators useful intelligence without turning the mere presence of an LLM into a claim of autonomous compromise.