CrowdStrike says agentic AI has compressed attack intrusions to minutes
CrowdStrike says AI agents now drive ransomware and espionage intrusions; one agent ran an entire operation in minutes before defenders could respond.
In the last 30 days, CrowdStrike tracked 26 agentic adversaries, more than the number it tracked in the entire preceding year, Meyers said. He cited REVENANT SPIDER as a tracked group that used an agent in an intrusion and said AI agents are now part of ransomware operations.
Meyers described one agent-driven intrusion by VAULT PANDA in which 1,100 commands were executed in 58 minutes. “It was an agent that was doing it, and we were watching it learn in real time,” he said. According to CrowdStrike’s global threat report, average breakout time this year was 29 minutes, with the fastest at 27 seconds. Meyers said he is referring to an entire intrusion operation conducted in minutes from start to finish.
CrowdStrike has tried to counter the trend with collective action. Meyers said the company cooperated with law enforcement on the disruption of the Sality botnet, a decade-long effort against a network that had operated for 23 years. “Bluntly, we do need to bring the fight to the bad guys. I think we need to raise the cost of doing business for them,” he said. “We need to do it in a responsible way.”