Attackers Used AI Agents in Crypto Scams and Health Care Intrusions

AI agents have helped attackers pursue crypto scams and intrusions, while recovered coding sessions show how claims of authorization can persuade tools to continue potentially harmful security work.

Operators asserted that they owned target systems, described tasks as bug-bounty or capture-the-flag work, split risky steps across sessions and files, or used neutral wording. Those approaches can make harmful requests resemble legitimate cybersecurity testing, where similar techniques may be used. Some models refused requests; in other cases, operators rephrased them or switched to uncensored models.

One operation used AI to support a chatbot focused on cryptocurrency scams. A separate effort against Telegram Mini Apps mapped wallet takeover steps and staged a withdrawal. In at least one case, the agent dumped an app database containing more than 1,300 users and several hundred Toncoin (TON) wallet records.

Campaigns from May through August 2026 involved four threat actors who had not previously been publicly reported. They used AI agents to choose actions and run commands. One operator compromised at least 15 health care entities in Argentina and took credentials and medical records from at least one victim. An Indonesian-speaking operator periodically intervened to get Claude Code past its safety controls.

A controlled evaluation tested BRANCH, an adaptive method for bypassing guardrails, which monitor AI inputs and outputs for unsafe instructions. BRANCH bypassed six multi-scanner systems in all 120 test scenarios. It used 72.13% fewer queries per bypass on average than an exhaustive baseline. Bypass jobs averaged 2.9 hours, compared with 13.1 hours for the baseline. Bypasses generated by BRANCH also transferred to 29 of 32 previously unseen guardrails, including eight commercial black-box systems. The results describe controlled tests, not a real-world success rate.