Category: AI Agent Security | Reading time: 3 min
CrowdStrike published a report on October 21 finding that likely agentic intrusions, attacks carried out with AI agents doing much of the work, are running at three times the level of the first half of 2026 in the second half so far. The growth has been steep month to month: August was more than double July, and September doubled August.
What CrowdStrike saw
The report tracks four threat actors. Two used sophisticated agent harnesses, the software that strings model calls into multi-step attacks. Two used simple setups. Even the groups with basic tooling breached organizations, and CrowdStrike observed the AI solving problems that were not in the attackers' existing playbooks.
The barrier is cost, not skill
According to the report, the primary barrier holding these attackers back is token budgets, meaning how much they can spend on AI model usage. Skill and tooling are no longer the main constraint.
Why it matters
If an attacker's reach is limited mainly by what they can spend on inference, the pace of agent-driven intrusions will track falling model prices. For defenders, that means more attempts, faster iteration and techniques that do not match known patterns. The same report is a reminder for enterprises running their own agents: an agent with broad credentials is exactly what these attackers are trying to reach or imitate. Limiting what each agent is permitted to do, checking each sensitive action before it runs, and keeping records that show which actions were authorized become baseline controls rather than extras.
Source: Cybersecurity Dive