{
 "public_id": "AIR-2026-0025",
 "incident_id": "2026-02-crowdstrike-genai-tool-abuse-in-the-wild",
 "date_disclosed": "2026-02",
 "date_occurred": "2025",
 "title": "CrowdStrike: 90+ organizations had legitimate AI tools exploited to generate malicious commands and steal data in 2025",
 "class": "in_the_wild",
 "attack_surface": "enterprise_assistant",
 "initial_vector": "prompt_injection_unspecified",
 "agent_capability_abused": [
  "command_generation",
  "tool_calling"
 ],
 "target_product": "unspecified legitimate generative AI tools",
 "target_vendor": "multiple",
 "autonomy_level": "assistant",
 "impact_realized": true,
 "impact_type": [
  "credential_theft",
  "data_exfiltration",
  "cryptocurrency_theft"
 ],
 "blast_radius": "90+ organizations during 2025",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "in_the_wild",
   "prompt_injection",
   "credential_theft",
   "threat_report_aggregate"
  ]
 },
 "defense_present": "unknown",
 "defense_bypassed": true,
 "fix_shipped": "n/a",
 "primary_sources": [
  "https://www.crowdstrike.com/en-us/global-threat-report/"
 ],
 "verified_quote": "90+ organizations had legitimate AI tools exploited to generate malicious commands and steal sensitive data.",
 "confidence": "high",
 "notes": "This is the strongest evidence on record that enterprise gen-AI assistant abuse has moved from proof of concept to real-world exploitation, but it is an aggregate statistic from the CrowdStrike 2026 Global Threat Report, not a named incident: the specific products, victims, and threat actors are NOT identified on the cited page. The YYYY-MM in the incident_id reflects the report's typical Feb/Mar publication window and was NOT independently verified; date_disclosed is left null for that reason. Anyone using this record should pull the full report PDF to pin down product names and actor attribution before citing it as an enterprise-assistant incident specifically. | date_disclosed is recorded to the month only; no source establishes the exact day.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Tool & Function Call Extraction / Abuse",
 "risk_sub_secondary": [
  "Prompt Injection",
  "Credential & Secret Theft"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the AI tools generated and ran malicious commands, stealing data",
 "vector_family": "direct_prompt_injection",
 "vector_detail": "prompt_injection_unspecified",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "threat_intel",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "credential_theft"
 ],
 "eai_reason": "impact rule: data_exfiltration_channels",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}