The 2026 Agentic Adversaries Report
AI Has Become an Autonomous Attacker. Here’s the Proof. AI is no longer just helping adversaries move faster. It's making decisions, adapting tactics, and executing intrusions with minimal human direction. CrowdStrike Counter Adversary Operations uncovered four previously unreported threat actors weaponizing AI agents in real-world intrusion campaigns, revealing a new level of speed, autonomy, and accessibility for attackers.
Report Snapshot
- AI is executing real-world intrusions: Threat actors are using AI agents across the attack life cycle, from reconnaissance to data theft.
- Attacks can unfold in minutes: An AI agent moved laterally and harvested domain controller credentials in approximately 20 minutes without additional human guidance.
- AI is lowering the barrier to entry: Even low-skilled attackers are using AI to compromise organizations.
- AI safeguards can be bypassed: All four threat actors overcame commercial AI safety controls to enable malicious activity.