In the wild
Realized harm
CrowdStrike: 90+ organizations had legitimate AI tools exploited to generate malicious commands and steal data in 2025
AIR-2026-0025 AIR record · 2026-02-crowdstrike-genai-tool-abuse-in-the-wild
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
90+ organizations had legitimate AI tools exploited to generate malicious commands and steal sensitive data.crowdstrike.com
The record
Disclosed
2026-02
Occurred
2025
Vendor
multiple
Product
unspecified legitimate generative AI tools
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft
System type
Generative model
Who acted
Agent acted — the AI tools generated and ran malicious commands, stealing data
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Prompt injection unspecified
Impact type
Credential theft, Data exfiltration, Cryptocurrency theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
90+ organizations during 2025
Capability abused
Defense & remediation
Recorded defense
unknown
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
n/a
Taxonomy & references
Curator notes
This is the strongest evidence on record that enterprise gen-AI assistant abuse has moved from proof of concept to real-world exploitation, but it is an aggregate statistic from the CrowdStrike 2026 Global Threat Report, not a named incident: the specific products, victims, and threat actors are NOT identified on the cited page. The YYYY-MM in the incident_id reflects the report's typical Feb/Mar publication window and was NOT independently verified; date_disclosed is left null for that reason. Anyone using this record should pull the full report PDF to pin down product names and actor attribution before citing it as an enterprise-assistant incident specifically. | date_disclosed is recorded to the month only; no source establishes the exact day.
Supporting sources
Cite as
Enkrypt AI. "CrowdStrike: 90+ organizations had legitimate AI tools exploited to generate malicious commands and steal data in 2025". AIR, AIR-2026-0025. https://agentincident.vercel.app/i/AIR-2026-0025/ (accessed 2026-10-19).