Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-10-21

HighPrimary

An Operator Used Claude Code Skills to Compromise Indonesian Government Domains

CrowdStrike reports an Indonesian-speaking operator loading Claude Code with 819 mostly public skills rather than a separate orchestration system. The.

Claude Code / public offensive skillsGovernance bypassReported agent authority-boundary failureAttacker-controlled agent tools and victim identity/data boundaries

What happened

Conducting agent-driven intrusion attempts with public skills and operator intervention

Why it matters

Government-domain and private-sector compromises reported by CrowdStrike; detailed victim identities are not public.

Missing authorization check

Independent authorization for conducting agent-driven intrusion attempts with public skills and operator intervention

Would PP block it?

An independently enforced gate in the agent operator's own environment could bind consequential actions to an approved target and task. That is a deployment condition, not protection supplied to an unwilling third-party target.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-10-21

    The cited source discloses the behavior documented in this record.

Technical breakdown

  • CrowdStrike reports an Indonesian-speaking operator loading Claude Code with 819 mostly public skills rather than a separate orchestration system. The operator directed the agent to compromise targets and intervened when safeguards or barriers stopped progress. CrowdStrike reports compromises of several Indonesian government domains, a government domain in another country and private-sector entities. The skill count is not a count of successful exploits.
  • Conducting agent-driven intrusion attempts with public skills and operator intervention
  • Government-domain and private-sector compromises reported by CrowdStrike; detailed victim identities are not public.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Attacker-controlled agent tools and victim identity/data boundaries
Still needs
PP is not a perimeter defense and cannot stop an outside agent using its own tools or stolen credentials against an unintegrated service. Patching, identity controls, isolation and network restrictions remain necessary.
Receipt required for
Conducting agent-driven intrusion attempts with public skills and operator intervention

An internal gate at the affected organization cannot constrain an externally operated agent that does not route its actions through that gate.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop