CrowdStrike 2026 Threat Hunting Report: AI as Both Weapon and Target

Industry-wide, covering the 12 months ending June 2026

CrowdStrike reported that 88% of vulnerabilities are now weaponized within 48 hours, compressing practical patching windows from roughly 30 days to 24 to 48 hours, and that China-nexus adversaries exploited critical vulnerabilities within 24 hours of public proof-of-concept release. DPRK-nexus STARDUST CHOLLIMA poisoned 131 trusted Mastra AI framework packages. Malicious npm packages accounted for 87% of identified software registry threats in the first half of 2026. AI agent-driven behaviors generated 2.5 signals for every human-triggered signal in CrowdStrike telemetry, against roughly 14 million detections processed daily and about 36,000 customer alerts over the period, and AI-enabled malicious activity rose 89% year over year. The TeamPCP cluster compromised more than 300 software dependencies in a single day. Adam Meyers, head of counter adversary operations, summarized the finding: "AI is the weapon and the target. We've seen that AI is being used by more and more threat actors and is a high value attack surface"

Not an incident. Reported here for the statistics on AI-accelerated exploitation timelines and on AI frameworks as a targeted supply chain