Most of the conversation about AI and security focuses on adversaries using AI. The CrowdStrike 2026 Global Threat Report surfaces the inverse, and more novel, dimension: adversaries attacking AI. As AI gets embedded into development pipelines, SaaS platforms, and operational workflows, the AI systems themselves become part of the attack surface. For a security program, this is the frontier that point-in-time assessments are least equipped to cover.

Three ways to attack an AI system

CrowdStrike's data clusters the threats into recognizable patterns. They are worth separating, because they call for different defenses.

1. Exploiting the platform directly

Since April 2025, threat actors have abused trust in AI development platforms to exploit a code-injection vulnerability — CVE-2025-3248 — affecting Langflow, a low-code platform for building AI agents and workflows. Cerber ransomware operators used it to establish persistence, access credentials, and deploy ransomware, distributing hundreds of ransom notes.

The lesson is unglamorous but critical: an AI platform is software. It has dependencies, it has CVEs, and it needs vulnerability management like any other production system. "Securing AI" is not only about model behavior — it is about patching the infrastructure the models run on.

The reframe: Organizations often treat their AI stack as a research toy or a product feature, not as production infrastructure subject to the same exposure management as everything else. The Langflow case shows why that gap is dangerous: the AI agent builder was the ransomware entry point.

2. Mimicking trusted AI infrastructure

In Q3 2025, threat actors published a malicious MCP server named postmark-mcp, impersonating a legitimate server maintained by Postmark. The legitimate version lets AI agents interact with the Postmark API for email services. The malicious version modified the server to forward users' emails to an attacker-controlled address.

This is supply-chain compromise translated into the agentic era. MCP (Model Context Protocol) servers are how AI agents reach external tools and data — and agents trust them with real access. A poisoned connector inherits that trust silently.

3. Turning the victim's own AI tools against them

The most striking pattern is adversaries weaponizing the AI tooling already installed in a victim's environment. CrowdStrike Intelligence documented two npm supply-chain campaigns that capture the scale:

90+
customers running adversary-originated code via weaponized local AI CLI tools (Aug 2025 Nx campaign)
690
npm packages compromised to spread the self-propagating ShaiHulud stealer (Nov 2025)
7
cloud regions in which a threat actor invoked a stolen-credential AI model in a CrowdStrike honeypot

In the August 2025 campaign, malicious Nx build packages uploaded to npm contained JavaScript designed to use victims' own local AI command-line tools — including Claude and Gemini — to generate commands that stole authentication materials and cryptocurrency assets. CrowdStrike Services and OverWatch responded to more than 90 affected customers.

Then in November 2025, threat actors compromised 690 packages to distribute a new version of the self-propagating information stealer ShaiHulud. To study how stolen credentials get used, CrowdStrike planted a honeypot of exposed credentials in a public GitHub repository. In one instance, a threat actor used those credentials to invoke an Anthropic Claude model across seven geographically distributed cloud provider regions.

The agentic frontier

CrowdStrike notes evidence that some threat actors have executed operations using agentic AI via Model Context Protocol tools — workflows requiring minimal human oversight. The report is careful here: adversaries have not adopted these methods at scale. But the direction is unmistakable. Such novel uses could substantially alter operational patterns, increase activity scale, and accelerate attacks.

Prompt injection meets the SOC: The threats run in both directions. Threat actors have begun experimenting with prompt injection against AI-enabled security workflows — in one reported case, embedding hidden prompt content within a phishing email to confuse or disrupt AI-based email triage and increase the chance the message evades detection. As defenders adopt AI in the loop, the inputs to those systems become a target. These techniques have not yet shown consistent effectiveness at scale, but they illustrate the attack pattern clearly.

Public interest as an attack vector

Finally, adversaries exploit the sheer enthusiasm around AI. Threat actors distributed BRASH SPIDER's Doshell stealer and COOKIE SPIDER's SHAMOS malware by marketing them as LLMs — including fake DeepSeek AI — or as promotional materials for fake AI projects. In one case, SHAMOS spread via malvertising that exploited ChatGPT shared links, deceiving users searching for macOS solutions into executing malicious commands.

The trust users place in AI brands is itself exploitable. "It's an AI tool" has become a social-engineering lure in its own right.

What this means for a security program

The defenses here are not exotic — they are the discipline of treating AI as production infrastructure:

  • Inventory and patch AI platforms and their dependencies the way you would any internet-facing application.
  • Vet the provenance of MCP servers and connectors before granting agents tool access; scope their permissions tightly.
  • Restrict and monitor what locally installed AI CLI tools are permitted to execute.
  • Add input validation and human checkpoints to any AI-in-the-loop security workflow.
  • Extend continuous adversarial testing to cover the AI stack — not just the models, but the agents, connectors, and pipelines around them.

The attack surface has quietly expanded to include the tools meant to make defenders faster. Continuous validation is how you find out whether that expansion has opened a door before an adversary does.

Source: CrowdStrike 2026 Global Threat Report. All figures and incidents attributed to CrowdStrike Intelligence's 2025 observations. Tadpole AI tracks adversary tradecraft across this and other gold-standard sources to inform continuous adversarial testing.

See what continuous testing finds in your environment.

Tadpole deploys autonomous agents that simulate real adversaries — 24/7, across your entire attack surface.

Request early access →