Summary
- AI-enabled adversary activity rose 89 percent in 2025, with nation-state and financially motivated groups both accelerating their use of AI across the attack chain.
- LLMjacking and AI cost-harvesting are emerging threats: stolen credentials are being used to abuse frontier-model APIs, with one documented campaign sending 200,000 API requests in two minutes.
- North Korea’s Famous Chollima built AI-generated fake companies, websites, and GitHub infrastructure to support insider-threat operations targeting AI-focused development environments.
- 88 percent of observed exploitation using public proof-of-concept code occurred within 48 hours of release; China-linked groups moved within 24 hours.
- CVE volumes are on track to exceed 2025’s 48,200 total before year-end, with more than 7,600 bugs reported in June alone.
A dual threat emerges
CrowdStrike’s latest Threat Hunting Report frames AI as occupying two distinct and concurrent roles in the current threat landscape. Adversaries are using AI to accelerate and automate attacks, while organisations’ own AI infrastructure has become a high-value target in its own right. “AI is both the weapon and the target,” said Adam Meyers, senior vice president of CrowdStrike’s counter adversary division. The firm’s threat hunting team now processes AI agent-triggered leads at 2.5 times the rate of human-triggered ones, a ratio that holds across both government-backed groups and financially motivated criminal crews.
Credential theft at API scale
Two attack patterns specific to AI infrastructure are drawing attention. In LLMjacking, attackers steal corporate credentials to gain unauthorised access to frontier-model APIs and use them at the victim’s expense. In cost-harvesting campaigns, the objective is deliberate inflation of a target’s AI usage bill. CrowdStrike documented one token-theft campaign that generated approximately 200,000 API requests within two minutes — a volume that illustrates how quickly operational and financial damage can accumulate once credentials are compromised.
Famous Chollima’s AI-assisted insider threat operations
Of the more than 290 adversary groups CrowdStrike currently tracks, it singles out Famous Chollima — a sub-unit of North Korea’s Lazarus Group — as having demonstrated the most advanced AI usage in the period covering the second half of 2025 and first half of 2026. The group constructed entire fictitious companies, complete with AI-generated websites, GitHub accounts, and email infrastructure, to support insider-threat operations. A supply-chain campaign between January and February targeted cryptocurrency and blockchain companies, with trojanised repositories published on GitHub containing legitimate-looking project files alongside hidden malicious scripts that executed automatically when opened by developers.
Supply chains remain the primary entry point
AI supply-chain compromise ranked as the second most common MITRE ATLAS technique used for initial access. The risk extends into the CI/CD pipelines that AI systems depend on, according to Meyers. A separate financially motivated group CrowdStrike tracks as Altered Spider compromised more than 300 software dependencies in a single day, harvesting credentials and secrets before pivoting rapidly into cloud environments. Meyers described the group’s speed plainly: it “hits the endpoint in seconds and within minutes, they’re inside of the cloud.” CrowdStrike’s threat hunters also suspect a separate Lazarus Group offshoot was involved in the March Axios supply-chain attack, and Amazon recently attributed four npm compromises over the past 18 months to the same North Korean crew.
The 30-day patch window is gone
The report presents a stark picture for vulnerability management teams. From January to June this year, 88 percent of observed exploitation using publicly available proof-of-concept code occurred within 48 hours of that code’s release. China-linked groups including Vault Panda and Genesis Panda moved even faster, launching attacks within 24 hours of disclosure. “The 30-day patch window, which frankly, was aspirational, is completely obsolete,” Meyers said. “We’re down to 24-hour, 48-hour patch cycles, and organisations are really struggling under that.”
CVE volumes compound the pressure
The volume problem is compounding the speed problem. In 2025, approximately 48,200 CVEs were registered. As of late July this year, the total had already reached roughly 43,000, with June alone accounting for more than 7,600 reported vulnerabilities. AI tooling is increasingly capable of finding code flaws at scale, meaning the pipeline of new vulnerabilities is not expected to slow. More CVEs means more reverse-engineering of vendor patches, and more opportunities for attackers to develop exploits before defenders can deploy fixes.
Why it matters
For CISOs, this report shifts two assumptions that have underpinned security programmes for years. First, AI infrastructure — APIs, development environments, CI/CD pipelines — is now a target category in its own right, not simply a productivity layer sitting above existing systems. Organisations that have deployed AI tools without extending their threat modelling and access controls to cover those surfaces carry meaningful, unquantified exposure. Second, the exploitation timeline data effectively retires risk-based patching models that depend on weeks of prioritisation time. If 88 percent of public PoC exploitation occurs within 48 hours, the operational question is no longer which patches to apply this month — it is which systems can tolerate an hours-long response window and which cannot.
What to do now
- Audit access controls and credential management for all AI API keys and frontier-model integrations, treating them with the same sensitivity as privileged infrastructure credentials.
- Extend threat modelling to cover AI-specific attack surfaces, including LLM API endpoints, AI agent pipelines, and CI/CD pipelines used to deploy AI systems.
- Review software dependency and supply-chain controls, particularly for development environments that interact with AI tooling or host AI-adjacent repositories.
- Reassess vulnerability management SLAs in light of the 48-hour exploitation window data — prioritisation frameworks that assume days or weeks of lead time may need revision.
- Monitor AI-related usage metrics and API billing anomalies as potential indicators of LLMjacking or cost-harvesting activity.
- Brief development teams on the risk of trojanised repositories, particularly those hosted on GitHub and targeting cryptocurrency, blockchain, or AI-focused projects.
