AI-Powered Cyberattacks Compress Intrusion Timelines to Minutes

AI Agents Now Core to Cyber Intrusions

Cybercriminals have moved beyond experimenting with artificial intelligence and are now actively deploying AI agents in ransomware campaigns, espionage operations, and hacktivist attacks. The integration of these tools is fundamentally changing the speed at which intrusions unfold, creating urgent challenges for security teams.

CrowdStrike has observed a sharp increase in what it calls "agentic adversaries"—threat actors using AI agents as operational tools. Adam Meyers, senior vice president of intelligence at CrowdStrike, reported that 26 such adversaries were tracked in the past 30 days alone, exceeding the total from the previous year. Groups like REVENANT SPIDER have incorporated AI agents directly into their ransomware operations, according to details first reported by Silicon Angle.

Intrusion Speed Reaches New Extremes

The operational tempo of these AI-driven attacks represents a dramatic acceleration. In one documented case, the VAULT PANDA group executed 1,100 commands in just 58 minutes, with the AI agent adapting and learning in real-time during the intrusion. This compressed timeline stands in stark contrast to CrowdStrike's previously reported average "breakout time"—the period between initial compromise and lateral movement—of 29 minutes.

The speed advantage stems from AI agents' ability to automate reconnaissance, privilege escalation, and lateral movement without human intervention. Where traditional attacks required manual command execution and decision-making at each stage, AI agents can process environmental data and execute multi-step attack chains autonomously.

Why it matters

The compression of intrusion timelines from hours to minutes fundamentally undermines traditional detection and response models. Security teams that once had a window measured in hours to detect and contain threats now face adversaries that can achieve their objectives before human analysts can mobilize. This shift forces organizations to invest in automated detection and response capabilities that can operate at machine speed, not human speed.

Defensive Countermeasures Evolve

Meyers emphasized that defenders must proactively counter these adversaries and increase the operational costs for threat actors, while doing so responsibly. CrowdStrike has been working with law enforcement on disruption operations, including the recent takedown of the Sality botnet—a threat that had been active for 23 years and took a decade of coordinated effort to dismantle.

The emergence of agentic adversaries signals that the cybersecurity industry has entered a new phase where AI capabilities on both sides of the conflict will determine outcomes. Organizations that fail to adopt AI-augmented defenses risk facing adversaries operating at speeds their current security infrastructure cannot match.

These findings were first reported by Silicon Angle based on insights from CrowdStrike's threat intelligence team.