CrowdStrike Warns AI Is Now Central to Cyberattacks

CrowdStrike has put a number behind a conflict spreading across Google News: attacks by AI-enabled adversaries increased 89% during 2025. The company says artificial intelligence now accelerates attacks while creating valuable new systems for criminals to target.

That combination matters more than another warning about convincing phishing emails. AI is moving deeper into reconnaissance, malware development, vulnerability exploitation, credential theft, and post-compromise activity. Attackers are also targeting the models, connectors, development tools, and cloud services that enterprises now trust.

The central contest is therefore not AI-equipped attackers against traditional antivirus software. It is machine-assisted offense against security operations still constrained by human review, fragmented visibility, and slow approval chains. Research from Google, Microsoft, and Anthropic supports that direction, although their evidence also exposes important limits in CrowdStrike’s framing.

The CrowdStrike Report Turns AI From an Experiment Into an Operating Layer

CrowdStrike’s most important claim is that AI has moved from isolated experimentation into the routine machinery of cyber operations.

The company released its 2026 Threat Hunting Report on August 3, drawing on incidents investigated during 2025 and the first half of 2026. Its findings describe attackers using AI as a tool, a target, and a force multiplier.

The report followed CrowdStrike’s February Global Threat Report, which documented an 89% annual increase in operations by AI-enabled adversaries. That earlier report also placed average eCrime breakout time at 29 minutes.

Breakout time measures the interval between an attacker’s initial access and lateral movement into another system. CrowdStrike says the 2025 average represented a 65% increase in speed from the previous year. Its fastest observed breakout took only 27 seconds.

The newer threat hunting findings add several concrete examples. CrowdStrike says China-linked adversaries exploited critical vulnerabilities within 24 hours after public proof-of-concept code appeared. It also attributes the poisoning of 131 AI framework packages to North Korea-linked actors.

In another campaign, attackers generated nearly 200,000 unauthorized large language model API requests within two minutes. This practice, often called LLMjacking, involves stealing access to a model service and shifting the resulting costs onto its legitimate customer.

CrowdStrike also recorded a doubling of voice-phishing intrusions during the first half of 2026 compared with the second half of 2025. Voice phishing, or vishing, uses calls and impersonation to manipulate employees into granting access or revealing credentials.

These figures do not mean AI independently planned every incident. They show that attackers can insert models into familiar workflows and operate those workflows at greater speed or volume.

The underlying attack goals remain recognizable. Criminal groups still want credentials, cryptocurrency, sensitive data, or extortion payments. State-backed operators still pursue espionage, persistence, and strategic access.

AI changes the economics around those goals. It reduces the effort required to research targets, produce tailored material, modify code, process stolen information, and repeat an attack across more victims.

The report also changes what counts as exposed infrastructure. An enterprise model is no longer just a productivity application. Its API credentials, data connectors, orchestration software, and development dependencies can all become attack paths.

That dual role creates the article’s central tension. Companies are adding AI to reduce operating friction, while attackers are searching the same environment for privileged access and weakly governed automation.

Why the Google News Headline Matters to Security Teams

The Google News framing matters because CrowdStrike is describing an operational timing problem, not merely another category of malicious software.

Security teams have long built defenses around a sequence. A tool detects unusual activity, an analyst reviews the signal, and someone decides whether to isolate a user or system. Each handoff consumes time.

A 29-minute average breakout time compresses that sequence. A 27-second outlier effectively removes the opportunity for manual review before the attacker reaches another asset.

That pressure falls most heavily on organizations whose security data remains divided among endpoints, identity platforms, cloud accounts, software services, and developer systems. An alert from one domain can appear harmless without context from the others.

Attackers benefit from those boundaries. A valid account signing into a cloud service can resemble normal work. A developer tool downloading a package may look routine. An AI assistant calling an approved connector can also pass through conventional controls.

CrowdStrike reported that 82% of its detections during 2025 involved malware-free activity. Malware-free attacks rely on legitimate credentials, trusted tools, or built-in system functions instead of dropping a recognizable malicious file.

AI complements that approach because models can help attackers interpret environments and adjust commands. The resulting behavior can resemble ordinary administrative work until multiple signals are combined.

Microsoft describes a similar shift in its analysis of AI threat activity. It says threat actors are embedding AI across planning, reconnaissance, malware development, phishing, and post-compromise operations.

However, Microsoft adds a useful qualification. Humans still direct most observed campaigns, even when AI reduces friction throughout the attack lifecycle.

That distinction affects defensive priorities. Organizations should not prepare only for a fictional autonomous hacker that operates without supervision. They must address human-run campaigns that become cheaper, faster, and easier to scale.

The forced response is operational rather than cosmetic. Security teams need controls that can correlate activity across identities, endpoints, cloud workloads, software services, and AI applications.

They also need authority to contain high-confidence threats quickly. Automated detection offers limited value if isolation still waits inside a long approval queue.

The pressure extends beyond security departments. Developers choose model frameworks and packages. Procurement teams authorize AI vendors. Employees connect assistants to documents, calendars, source code, and customer systems.

Every connection can carry useful business context. It can also widen the consequences of a compromised account, poisoned dependency, or manipulated prompt.

The near-term challenge is therefore governance at operational speed. Enterprises must know which models are running, which data they can reach, which actions they can take, and how access can be revoked.

Longer term, organizations will need to redesign incident response around machine-speed investigation. A human analyst should remain accountable, but that person cannot manually reconstruct every cross-domain event before containment begins.

AI-Enabled Attackers Face AI-Assisted Defenders

The primary contest is speed and coordination: attackers automate steps across a campaign while defenders try to automate evidence gathering and containment.

CrowdStrike presents AI as a force multiplier for adversaries. That description is credible because an attacker does not need a model to invent a new class of exploit. Improving several ordinary tasks can produce a meaningful cumulative advantage.

A model can summarize public information about a target, translate messages, generate variations of a lure, explain unfamiliar code, and organize stolen data. It can also help less experienced operators complete tasks that once required specialists.

Anthropic examined 832 accounts banned for malicious cyber activity between March 2025 and March 2026. Its account analysis mapped observed behavior to the MITRE ATT&CK framework, a widely used catalog of attacker tactics and techniques.

Among those accounts, 560 used AI in activity related to preparing malware. That represented 67.3% of the studied group. Another 54 accounts, or 6.5%, used AI to assist with lateral movement inside compromised environments.

Anthropic also found that AI use was moving deeper into attacks. Account discovery inside compromised systems increased, while the share associated with AI-assisted phishing declined.

The company’s sample is not a measurement of all cyberattacks. It only covers accounts Anthropic identified, banned, and could analyze with enough detail. Still, the movement toward post-compromise work supports CrowdStrike’s broader direction.

Attackers gain additional leverage when models can chain tasks together. Instead of asking for a single script, an operator can build a system that selects tools, evaluates results, and chooses the next step.

That orchestration is more important than any individual prompt. It turns an AI model into one component inside a repeatable attack process.

Defenders possess comparable advantages. They can use AI to investigate alerts, summarize related events, prioritize vulnerabilities, generate queries, and propose containment actions. They also control the enterprise environment where those defenses run.

A defender can see historical identity behavior, approved devices, cloud entitlements, and expected application relationships. An outside attacker rarely begins with that complete context.

Google’s Mandiant team has described how structured AI review can help defenders analyze code and locate exploit paths. Its source code research reported 12 assigned vulnerabilities discovered through an agentic review process.

Yet defensive deployment carries a serious tradeoff. A security agent needs extensive access to investigate incidents and take action. Those privileges make the agent, its instructions, and its connectors attractive targets.

Organizations cannot simply attach a model to every security system and call the timing problem solved. They must restrict permissions, record actions, validate outputs, and preserve reliable ways to stop automation.

The side that coordinates better will hold the advantage. Attackers coordinate reconnaissance, access, exploitation, and data theft. Defenders must coordinate telemetry, identity controls, vulnerability management, and response.

This contest does not guarantee that offense wins. It does mean fragmented defensive workflows become more expensive as adversary workflows become easier to automate.

AI Is Also Becoming the Attack Surface

The sharpest reversal in CrowdStrike’s warning is that the technology hired to accelerate work can expose new paths into the enterprise.

Companies often discuss AI risk through model outputs. They consider whether an assistant might provide an incorrect answer, reveal confidential information, or produce prohibited content.

CrowdStrike’s research points toward a broader technical surface. Models sit inside systems containing API keys, vector databases, plugins, browser sessions, development tools, and third-party connectors.

Those components give an assistant useful context and the ability to act. They also create opportunities for credential theft, supply-chain compromise, prompt injection, and abuse of paid computing resources.

Prompt injection places hostile instructions inside content that an AI system processes. If the system follows those instructions, it can reveal information or trigger actions outside the user’s intent.

CrowdStrike says attackers injected malicious prompts into legitimate generative AI tools at more than 90 organizations. The prompts allegedly generated commands used for credential and cryptocurrency theft.

The company also observed attackers exploiting AI development platforms to establish persistence and deploy ransomware. In other cases, malicious servers impersonated trusted AI services to intercept sensitive information.

Google Threat Intelligence Group reached a similar conclusion in its AI threat tracker. Google says attackers increasingly target orchestration layers, wrapper libraries, API connectors, and skill configuration files.

Its researchers did not report attackers routinely defeating the core security logic of leading models. Instead, threat actors used familiar supply-chain and credential techniques against the surrounding software.

That finding prevents the analysis from drifting into science fiction. The immediate danger is usually not a mysterious model takeover. It is ordinary security failure appearing inside a new and highly connected stack.

A developer might install a compromised package. An exposed token might permit unauthorized model calls. A connector might grant wider document access than an employee realizes.

An attacker can also exploit trust between components. If an AI workflow treats retrieved web content as instructions, manipulated content can influence later actions.

The 131 poisoned packages identified by CrowdStrike illustrate the scale problem. Developers depend on public frameworks because rebuilding every capability internally is unrealistic. Attackers can exploit that dependency by imitating useful packages or compromising maintainers.

AI systems also create concentrated access. A single assistant may search internal files, summarize meetings, query customer records, and interact with development environments.

That concentration improves productivity. It can also allow one compromised identity or workflow to cross boundaries that previously required several separate accounts.

Security architecture must therefore treat models as untrusted interpreters, not unquestioned decision-makers. A model can recommend an action without receiving permanent authority to execute every action.

Least privilege remains essential. Each tool should receive only the data and permissions required for its immediate task. High-impact actions should require independent validation.

Organizations also need inventories of models, connectors, agents, and credentials. A security team cannot monitor AI infrastructure that business units deployed without registration or ownership.

CrowdStrike’s warning becomes most useful at this level. It directs attention away from sensational claims about intelligent malware and toward the real interfaces where enterprise AI meets valuable systems.

What CrowdStrike’s Numbers Do Not Establish

CrowdStrike provides strong evidence that AI is embedded in attacks, but its statistics do not prove that AI caused every increase in speed or volume.

The 89% growth figure measures activity CrowdStrike classified as involving AI-enabled adversaries. It does not represent the percentage of all attacks using AI, nor does it measure the damage attributable solely to models.

Detection changes can also affect annual comparisons. Researchers improve their methods, organizations deploy more telemetry, and threat actors leave new signals. Any of those changes can increase observed activity.

The 29-minute breakout average requires similar care. Faster movement can reflect stolen credentials, improved remote tools, weak identity controls, or experienced operators. AI can accelerate those activities without being their only cause.

CrowdStrike sells security products designed to detect and stop machine-speed attacks. Its telemetry offers valuable visibility, but its interpretation also supports the company’s commercial position.

That conflict does not invalidate the data. It makes independent corroboration essential.

Google says it has observed a transition toward industrial-scale generative AI use in adversarial workflows. It also reported what it believes was the first observed zero-day exploit developed with AI assistance.

Microsoft sees AI embedded across threat activity but emphasizes continued human direction. Anthropic found models being used later in attack chains, while noting that its 832-account sample was selective.

Together, these sources support a narrower and more defensible conclusion. AI is reducing friction across established attack techniques, and some actors are beginning to orchestrate more complex operations.

They do not establish that autonomous systems now dominate cybercrime. They also do not show that every attacker gains the same benefit.

Models still produce errors. Generated code can fail, invented technical details can waste time, and safeguards can block requests. Skilled operators remain better positioned to recognize and correct those failures.

Even autonomy needs infrastructure. An attacker must provide tools, access, memory, targets, and decision rules. Each added component creates opportunities for detection and disruption.

Defensive AI also complicates predictions about attacker advantage. The same vulnerability analysis that helps an adversary can help a vendor patch software before exploitation.

Mandiant’s 2026 incident data provides another caution. Its frontline findings placed global median dwell time at 14 days, up from 11 days during 2024.

Dwell time measures how long an attacker remains inside an environment before detection or removal. It differs from breakout time, so the two metrics are not contradictory.

Instead, they show that attack speed has several dimensions. Some intruders move laterally almost immediately, while sophisticated groups can remain hidden for months.

A security program optimized only for fast ransomware could miss a patient espionage campaign. One optimized only for long investigations could fail against rapid identity-driven extortion.

The practical response is not panic buying. It is testing whether controls can detect both sudden movement and quiet persistence across the systems an organization actually uses.

Enterprises should also demand transparent measurement from vendors. Useful reporting should define the observed population, explain classification methods, and separate AI involvement from AI causation.

CrowdStrike’s headline is valuable because it identifies a directional change. Its numbers should guide investigation, not become a substitute for each organization’s own evidence.

Three Signals Will Show Whether AI Has Changed Cyberattacks for Good

The next test is whether observed AI use becomes repeatable across attack stages, supply chains, and real enterprise incidents.

The first signal is evidence of sustained post-compromise automation. Researchers should watch whether attackers repeatedly use models for privilege escalation, account discovery, lateral movement, and data collection.

Phishing volume alone would strengthen only the weakest version of CrowdStrike’s argument. Documented orchestration after access would support the claim that AI has become an operating layer.

Anthropic’s research already points in that direction. The stronger evidence will come from multiple providers observing the same progression across unrelated campaigns.

If post-compromise use remains rare, CrowdStrike’s centrality claim will look premature. AI would still matter, but mostly as a productivity tool for familiar attacks.

The second signal is the frequency and impact of AI supply-chain compromises. The 131 poisoned packages identified by CrowdStrike provide a baseline, not a settled trend.

Security teams should watch public package registries, model hubs, connector marketplaces, and agent configuration repositories. They should also track how often compromised AI components create access to wider business systems.

More incidents involving trusted packages would strengthen the argument that AI is both an attack tool and a valuable target. Limited downstream impact would weaken the most alarming interpretation.

The third signal is whether defenders reduce response time without creating new failures. Vendors will continue adding AI investigation and containment features, but adoption alone proves little.

Organizations need evidence that these systems correlate cross-domain activity, shorten validated containment, and avoid harmful automated actions. They must also show that attackers cannot manipulate the same agents through poisoned inputs.

This measurement should include time from first signal to containment, not only time from alert to analyst review. It should distinguish fully automated actions from human-approved responses.

A falling containment time would indicate that defenders are absorbing the same speed advantage as attackers. Continued delays would show that organizational processes remain the limiting factor.

For readers arriving through Google News, the durable message is straightforward. CrowdStrike has documented a meaningful increase in AI-related adversary activity, but the technology has not replaced the fundamentals of cybersecurity.

Credentials still require protection. Software dependencies still require verification. Identities, cloud services, endpoints, and AI connectors still need coordinated monitoring.

The difference is time. Attackers can now research, adapt, and repeat portions of their work faster. Enterprises are also connecting AI to systems that hold unusually broad access.

Security leaders should ask one immediate question: can their organization identify and contain a trusted-looking intrusion before it crosses into another domain? The answer will reveal more than any headline about an AI arms race.