CrowdStrike (NASDAQ: CRWD) released its 2026 Threat Hunting Report on Aug 3, 2026, revealing that artificial intelligence has become deeply embedded in modern adversary operations. The report indicates that threat actors are now using AI as both a tool and a target, significantly accelerating the speed and scale of cyberattacks. For enterprises, this shift means exploitation windows have collapsed from days to hours, forcing security teams to defend against AI-driven threats that move faster than traditional human-led campaigns. This operational reality underscores an urgent need for organizations to secure their AI infrastructure as aggressively as they adopt it.

The findings are based on frontline intelligence from CrowdStrike’s elite threat hunters and intelligence analysts, who track more than 290 named adversaries. Adam Meyers, head of counter adversary operations at CrowdStrike, stated that AI is changing how attacks are planned, executed, and scaled. He noted that the organizations that succeed will be those that use AI to defend at the speed of the adversary.

Key Findings from the 2026 Threat Hunting Report

The report outlines several critical trends in adversary behavior during the first half of 2026:

Supply Chain and AI Infrastructure Targets

The AI ecosystem has emerged as the next supply chain battleground. DPRK-nexus adversary STARDUST CHOLLIMA injected malicious code into 131 trusted Mastra AI framework packages via npm. During the first half of 2026, 87% of identified software registry threats involved malicious npm packages. Meanwhile, eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments.

Adversaries are also following AI workloads into the cloud. Cloud-conscious eCrime activity surged by 171%, with actors executing credential theft, cryptomining, large language model (LLM) abuse, and digital financial asset theft. In one notable campaign, adversaries sent nearly 200,000 AI model requests in just two minutes, demonstrating the scale at which AI infrastructure can be abused.

Authentication and Detection Dynamics

Trusted authentication mechanisms are increasingly becoming attack paths. Vishing intrusions doubled in the first half of 2026. ECrime groups CORDIAL SPIDER and SNARKY SPIDER compromised single sign-on (SSO) integrated SaaS applications for data exfiltration. In one incident, SNARKY SPIDER moved from account takeover to data theft in under five minutes. Monthly device code phishing attempts increased by 15x in 1H 2026, reflecting the growing abuse of trusted authentication workflows.

On the defense side, CrowdStrike OverWatch observed that AI agent-triggered detection leads grew at 2.5x the rate of human-triggered leads. This acceleration highlights how AI is increasing the volume and velocity of activity that security teams must investigate, necessitating automated protection and remediation capabilities.

What the Numbers Show

The convergence of AI adoption and adversary capability is compressing the time available for response. With 88% of vulnerabilities being exploited within 48 hours of proof-of-concept release, and specific state-aligned actors like VAULT PANDA moving within 24 hours, traditional patching cycles are no longer sufficient. The data suggests that the primary risk is no longer just the existence of a vulnerability, but the speed at which AI-enabled adversaries can weaponize it. Furthermore, the 15x increase in device code phishing attempts indicates that attackers are systematically bypassing traditional multi-factor authentication by exploiting trusted user workflows, shifting the burden of defense onto behavioral detection rather than static credentials.

CrowdStrike Holdings Inc. (NASDAQ: CRWD) and Cerebras Systems Inc. (NASDAQ: CBRS) announced a strategic partnership to combine the industry’s leading AI-native security platform with the world’s fastest AI inference. The collaboration aims to enhance real-time protection for enterprises building and deploying AI at scale by pairing Cerebras’s inference speed with CrowdStrike’s Falcon AI Detection and Response (AIDR). This partnership addresses the need for security that reasons and acts at machine speed to defend against faster, more targeted AI-accelerated threats.

Under the agreement, CrowdStrike will leverage Cerebras’s industry-leading inference speed to power its Falcon AIDR models. This integration is designed to enable larger, smarter models to run fast enough for real-time protection, stopping threats sooner, including those missed by legacy systems. Simultaneously, Cerebras has standardized on the CrowdStrike Falcon platform to secure its own business operations, reflecting a trend where AI infrastructure providers choose CrowdStrike to protect their innovations.

Strategic Benefits

The partnership extends CrowdStrike’s leadership in AIDR, a category it pioneered to secure AI across every surface, from data and models to agents and identities. For Cerebras, the collaboration brings its inference speed, trusted by demanding AI workloads, to the critical application of securing enterprises in real-time. The companies emphasize that every millisecond matters in cybersecurity, determining whether AI prevents an attack or merely explains it afterward.

Executive Perspectives

Naor Penso, CISO of Cerebras, highlighted the importance of speed in AI security, stating that security cannot wait for slow AI during an attack. Daniel Bernard, chief business officer at CrowdStrike, noted that running Falcon AIDR models on Cerebras puts the world’s best security AI on the world’s fastest inference, driving rapid adoption of fast and secure AI.

Partnership Details

As AI reshapes the enterprise, the partnership positions CrowdStrike and Cerebras as key enablers for innovators building on fast AI infrastructure.