- Artificial intelligence is accelerating cyber attacks and expanding the number of ways organisations can be targeted
- CrowdStrike found that criminals are increasingly weaponising AI
- The report revealed that AI-enabled adversaries increased their operations by 89 per cent year-on-year
Artificial intelligence is accelerating cyber attacks and expanding the number of ways organisations can be targeted, according to a new global security report.
The 2026 Global Threat Report from cybersecurity firm CrowdStrike has found that criminals are increasingly weaponising AI while also exploiting AI systems themselves, dramatically reducing the time it takes to compromise networks.
The report revealed that AI-enabled adversaries increased their operations by 89 per cent year-on-year, using the technology for reconnaissance, credential theft and evasion.
At the same time, the average eCrime breakout time – the time it takes for attackers to move from initial access to wider control of a system – fell to just 29 minutes in 2025, with the fastest case recorded at 27 seconds.
CrowdStrike said attackers are now increasingly moving through trusted identities, software-as-a-service platforms and cloud infrastructure, allowing malicious activity to blend in with normal operations and reducing the time available for defenders to respond.
Researchers also found that attackers are not only using AI but targeting it directly.
The report said oppositional groups exploited legitimate generative AI tools at more than 90 organisations by injecting malicious prompts designed to generate commands capable of stealing credentials and cryptocurrency.
Hackers also abused vulnerabilities in AI development platforms to maintain persistent access and deploy ransomware, while malicious AI servers impersonating trusted services were created to intercept sensitive data.
According to CrowdStrike’s intelligence teams, AI has significantly accelerated the speed of cyber intrusions.
The average breakout time of 29 minutes represents a 65 per cent increase in speed compared with 2024, while in one incident, attackers began exfiltrating data within four minutes of gaining access.
The report also highlights a sharp rise in AI use by state-linked groups and organised cybercrime gangs.
Cyber activity linked to China increased 38 per cent in 2025, with the logistics sector experiencing the sharpest rise at 85 per cent.
The report said 67 per cent of exploited vulnerabilities by China-linked actors delivered immediate system access, while 40 per cent targeted internet-facing edge devices.
Incidents tied to North Korea rose by more than 130 per cent, as activity from hacker group, FAMOUS CHOLLIMA, more than doubled.
Another North Korean group, PRESSURE CHOLLIMA, carried out a USD $1.46bn cryptocurrency theft, described in the report as the largest single financial heist ever reported.
The report also highlights growing use of zero-day vulnerabilities, with 42 per cent exploited before public disclosure.
Cloud-focused attacks are also rising sharply, with cloud-conscious intrusions increasing by 37 per cent overall and a 266 per cent rise among state-linked threat actors, who are increasingly targeting cloud infrastructure for intelligence gathering.
Adam Meyers, head of counter adversary operations at CrowdStrike, said the findings show how rapidly the cyber threat landscape is evolving.
“This is an AI arms race,” said Adam Meyers, head of counter-adversary operations at CrowdStrike. “Breakout time is the clearest signal of how intrusion has changed. Adversaries are moving from initial access to lateral movement in minutes. AI is compressing the time between intent and execution while turning enterprise AI systems into targets. Security teams must operate faster than the adversary to win.”
