CrowdStrike Report Warns AI is Both a Cyber Weapon and a Target for Attackers

AI as a Dual Threat

CrowdStrike's 2026 Threat Hunting Report highlights that artificial intelligence is now both a tool for cybercriminals and a vulnerable target. The report, published on Monday, indicates that the same AI models and workflows used for business growth are being exploited by malicious actors.

Expanding Attack Surfaces

As corporate networks expand and new large language models (LLMs) are deployed, organizations are inadvertently creating larger "undefended" attack surfaces. These surfaces can be exploited for data theft, AI model access, surveillance, and even to harvest computing power. Adam Meyers, head of threat intel at CrowdStrike, noted that threat actors are adopting AI at the same speed as other users.

Overwhelming Defensive Signals

The widespread adoption of AI is increasing the volume of signals that cybersecurity defenders must analyze. CrowdStrike's threat hunters now encounter 2.5 times more AI agent-triggered leads than manually driven leads, making it harder to distinguish malicious activity from legitimate AI-driven behavior. This rapid increase in signals underscores the speed of AI-driven attacks.

Examples of AI-Driven Attacks

The report provides examples of AI-driven malicious activity. The DPRK-associated group Famous Chollima weaponizes trusted AI environments and tools to target cryptocurrency and blockchain companies, using AI-generated resumes and deepfake interviews. Other groups, like Cordial Spider and Snarky Spider, use vishing to exfiltrate data from SaaS applications and compromise single sign-on accounts, with one attack shifting from account takeover to data theft in under five minutes. LLMJacking, another documented attack, involved nearly 200,000 API calls in two minutes.