AI-Enabled Threat Actors Accelerate Exploitation and Target AI Infrastructure

CrowdStrike reported that AI has become both an offensive enabler and a direct target in cyberattacks, with AI-enabled malicious activity rising 89% over the past year and generating more than twice as much potentially malicious detection noise as human-triggered activity. The company said attackers are using frontier models to identify vulnerabilities, generate scripts and payloads, automate intrusion workflows, and troubleshoot operations, while also pursuing attacks such as LLMjacking, AI cost-harvesting, and compromises of AI infrastructure and agentic systems. The findings align with earlier disclosures from OpenAI, which said it banned accounts tied to publicly reported China-linked actors including Vixen and Keyhole Panda, as well as suspected DPRK-affiliated operators, for using AI to support vulnerability research, scripting, phishing, malware research, translation, and cryptocurrency-focused targeting.

The report warns that AI is sharply compressing defender response time, with 88% of vulnerabilities reportedly weaponized within 48 hours, reducing effective patch windows to roughly 24 to 48 hours. CrowdStrike highlighted rapid post-disclosure exploitation by China-linked groups including Vault Panda and Genesis Panda, and described advanced AI-enabled tradecraft by North Korean actors such as Famous Chollima, including fake companies, AI-generated infrastructure, and trojanized repositories aimed at cryptocurrency, blockchain, and AI-focused development environments. It also cited expanding supply-chain risk, including TeamPCP’s compromise of more than 300 software dependencies in a single day and financially motivated activity such as Altered Spider stealing credentials and pivoting into cloud environments, underscoring how AI tools and integrations are widening an under-defended attack surface.