Adversaries Exploit AI Systems and Supply Chains in Surge of Attacks
According to CrowdStrike's 2026 Threat Hunting Report, threat actors are increasingly using AI as a weapon while simultaneously targeting AI infrastructure and systems. DPRK-nexus groups compromised AI framework packages, China-nexus adversaries exploited vulnerabilities within 24 hours of disclosure, and attackers abused enterprise LLMs at scale.
What happened
According to CrowdStrike's 2026 Threat Hunting Report, threat actors have operationalized AI as a tool, target, and force multiplier. DPRK-nexus group STARDUST CHOLLIMA injected malicious npm packages into 131 trusted Mastra AI frameworks. eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments.
China-nexus adversaries VAULT PANDA and GENESIS PANDA launched deliberate attacks within 24 hours of vulnerability disclosure, while 88% of identified vulnerability exploitations with public proof-of-concept occurred within 48 hours of release. One campaign sent nearly 200,000 AI model requests in two minutes to abuse enterprise LLMs. During the first half of 2026, 87% of identified software registry threats involved malicious npm packages.
Reported impact
CrowdStrike OverWatch observed AI agent-triggered detection leads grew at 2.5 times the rate of human-triggered leads, indicating AI is accelerating the volume and velocity of activity security teams must investigate. Cloud-conscious eCrime activity surged 171% as adversaries executed credential theft, cryptomining, LLM abuse, and digital financial asset theft.
The widespread adoption of new and unproven AI is increasing the volume of signals defenders must sort through, making it more difficult to distinguish malicious activity from expected AI-driven behavior.
Index analysis
The report reveals that threat actors have adopted AI at the same speed as legitimate organizations, transforming AI from solely a defensive tool to a weapon and attack surface. Adversaries are exploiting AI infrastructure, compromising software supply chains, abusing enterprise LLMs, and following AI workloads into the cloud.
Exploitation windows have collapsed as attacks move faster and scale more efficiently, with attacks increasingly targeting the AI systems enterprises depend on.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.