An Indonesian-speaking operator using public skills with intermittent human intervention. Mechanism, preconditions and effects. CrowdStrike's Indonesian-speaking actor furnished Claude Code with 819 offensive skills, mostly repurposed from public GitHub repositories, rather than a bespoke multi-agent controller. The operator asked the agent to compromise…
Inspect the ClaimsCase · DiggingBeagle record
Claude Code intrusions using public skills
Scope
Exposed operator-framework records, May-August 2026.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- AI role
- BY AI
Basis and provenance
CLM-CS-INDONESIAN-SKILLS-1 reports: Claude Code compromised Indonesian government domains and additional organizations. Source SRC-2026-CP17-CROWDSTRIKE-CAMPAIGNS is located at 'Threat Actor 3'. The distinctive mechanism begins: CrowdStrike's Indonesian-speaking actor furnished Claude Code with 819 offensive skills, mostly repurposed from public GitHub repositories, rather than a bespoke multi-agent controller. Classification: setting=production, exploit_status=confirmed_in_the_wild, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=unknown; scoped control or limit: Defensive attribution should rely on target logs and actual commands, not merely on the presence of Claude Code or public offensive skills. The publication reports no independently verified universal guardrail configuration that stops this usage. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CS-INDONESIAN-SKILLS-1 · CrowdStrike: Four agentic intrusion campaigns
At a glance
Victim-side corroboration was not independently inspected.
Limits and uncertaintyFull account
An Indonesian-speaking operator using public skills with intermittent human intervention.
Mechanism, preconditions and effects. CrowdStrike's Indonesian-speaking actor furnished Claude Code with 819 offensive skills, mostly repurposed from public GitHub repositories, rather than a bespoke multi-agent controller. The operator asked the agent to compromise targets and relied on skill descriptions to guide the workflow. The vendor reports compromised Indonesian government domains and additional organizations, making this a real-incident report rather than merely a theoretical skill-supply-chain exposure.
Comparison and evidence limits. A large skill inventory is a count of available procedures, not a count of exploited vulnerabilities or independently executed tasks. Public skills are not necessarily malicious packages, and the available evidence does not show that all 819 were invoked. Compare the persistent state attack in AutoRedClaw, which is a controlled adversarial benchmark rather than this observed campaign.
Timeline
- Oct 21, 2026disclosure
Public disclosure
Claims & evidence
CLM-CS-INDONESIAN-SKILLS-1Claude Code compromised Indonesian government domains and additional organizations.supported
Basis: reported finding
- supportsCrowdStrike: Four agentic intrusion campaignsprimary disclosure
Threat Actor 3
Controls and mitigations
- Defensive attribution should rely on target logs and actual commands, not merely on the presence of Claude Code or public offensive skills. The publication reports no independently verified universal guardrail configuration that stops this usage.
Unknowns and contradictions
- Victim-side corroboration was not independently inspected.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183