AI-Driven Cyberattacks Surge 89% as Patch Windows Collapse to 48 Hours

Cybersecurity is entering a volatile arms race as generative AI accelerates the speed and scale of digital incursions. According to CrowdStrike's annual Threat Hunting Report, AI-enabled adversary operations surged by 89% in 2025, fundamentally altering the timeline for vulnerability exploitation and infrastructure defense.

The report highlights a drastic compression in the window between the discovery of a flaw and its active exploitation. Between January and June, 88% of exploitations utilizing public proof-of-concept (PoC) code occurred within just 48 hours of the code's release. This rapid weaponization is evident in the behavior of state-sponsored actors; China-linked groups, including Vault Panda and Genesis Panda, have been observed launching attacks within 24 hours of a vulnerability disclosure. The scale of the threat is further underscored by the volume of vulnerabilities: approximately 48,200 CVEs were registered in 2025, and the count had already climbed to 43,000 by early August 2026.

The Dual Role of AI

Modern threat actors are utilizing AI not only to automate bug discovery and exploit creation but also to build sophisticated deceptive infrastructures. The North Korean group known as 'Famous Chollima' has leveraged AI to generate fake companies, websites, GitHub accounts, and email systems to facilitate insider threat operations.

Simultaneously, AI has become a high-value target. Attackers are increasingly focusing on the AI supply chain, targeting CI/CD pipelines and frontier-model APIs—a tactic known as "LLMjacking." As organizations integrate AI into their core operations, the infrastructure supporting these models has become a primary vector for financial theft and infiltration. Adam Meyers, senior VP of CrowdStrike's counter adversary division, notes that AI is now "both the weapon and the target."

The Death of the 30-Day Patch

This shift in adversary capability renders traditional security maintenance obsolete. For years, a 30-day patching cycle was considered a standard, if aspirational, goal for many enterprises. However, the speed at which AI can now weaponize a vulnerability means that organizations must transition to 24-to-48-hour patch cycles to avoid compromise.

Meyers emphasizes that the 30-day window is "completely obsolete," leaving many organizations struggling to keep pace with the near-instantaneous transition from disclosure to attack. The consequence is a landscape where the very tools intended to optimize business operations are being turned into liabilities.

Future Outlook

As the AI arms race intensifies, the industry must watch for further automation in the reconnaissance phase of attacks. While the surge in AI-enabled operations is confirmed, the long-term stability of AI supply chains remains a critical uncertainty. Organizations that fail to automate their own defense and patching mechanisms will likely find themselves unable to defend against the compressed timelines of AI-driven adversaries.