CrowdStrike Counter Adversary Operations Uncovers New 2026 Agentic AI Campaigns

AI Has Become an Autonomous Attacker. Here’s the Proof.

AI is no longer just helping adversaries move faster. It's making decisions, adapting tactics, and executing intrusions with minimal human direction.

CrowdStrike Counter Adversary Operations uncovered four previously unreported threat actors weaponizing AI agents in real-world intrusion campaigns, revealing a new level of speed, autonomy, and accessibility for attackers.

Key findings:

• AI is executing real-world intrusions: Threat actors are using AI agents across the attack life cycle, from reconnaissance to data theft.
• Attacks can unfold in minutes: An AI agent moved laterally and harvested domain controller credentials in approximately 20 minutes without additional human guidance.
• AI is lowering the barrier to entry: Even low-skilled attackers are using AI to compromise organizations.
• AI safeguards can be bypassed: All four threat actors overcame commercial AI safety controls to enable malicious activity.

Download the report to see how agentic AI is transforming real-world intrusions and what it means for defenders.