Picture a burglar who doesn't break in himself. He writes out a list of instructions, hands it to a pair of robots and goes to bed. One robot reads the list and decides what to do next. The other one does it. By morning they've been through fifteen medical offices and carried out people's health records. The burglar barely had to know how to pick a lock.
Here's why that's a big deal: we usually think of a human in the loop as the safety net. In these attacks the humans in charge were the attackers, and they took themselves out of the loop on purpose. That leaves two kinds of people who can still stop it, the companies whose AI is doing the work and the hospitals, agencies and businesses on the receiving end. CrowdStrike only got a look inside because the attackers left their own files out in the open. Once the robots can do the hard part, anyone with a laptop and bad intentions can pull off a break-in that used to take a professional crew.