CrowdStrike says four hacking groups now run AI agents on their own; its AIDR line grew 79-fold

AI agents are hacking on their own now, and CrowdStrike's▲+7.20% — CrowdStrike, up 7.20 percent today December print has to price it. The firm's October 22 threat report↗ documents four hacking groups running AI agents that chose their own techniques and breached numerous organizations ¹. The same firm sells the detector, the stock jumped on the same week's NVIDIA deal, and the early-December fiscal Q3 print is the first dollar test of whether documented fear becomes disclosed revenue ³⁴.

The question about AI hacking just stopped being hypothetical. CrowdStrike's threat-intelligence unit published a report on October 22 documenting four hacking groups that ran AI agents as autonomous operators, not just as tools for writing phishing emails: in campaigns between May and August, agents chose techniques, pivoted between victim networks and solved problems their human handlers never scripted ¹.

One agent supervised another in the Argentine healthcare breaches

One Spanish- and English-speaking group breached at least 15 Argentine healthcare organizations and stole medical records, running one Claude Code agent as a supervisor over an executor agent ¹². What is new since our last look at this trade, on October 16, is this report itself, plus confirmation that the fiscal Q3 print lands in early December rather than the October 31 date we had flagged as the test ¹².

Token budgets, not skill, are now the constraint

CrowdStrike's own line cuts deepest: for the two low-skill groups, "the primary barrier to scaling an AI-orchestrated intrusion campaign is not engineering complexity but token budgets" ¹. Read that as a demand curve. As inference costs fall, the constraint moves from skill to spend, and the firm logged a threefold rise in agentic intrusions in the second half of 2026, with September double August ¹.

The attackers used older Claude and open-weight DeepSeek models, exploited uneven guardrails across models↗, and needed no novel exploits, only speed and volume against unpatched, ordinary weaknesses ². Unskilled hackers matching nation-state technique within twelve months is a forecast, but the doubling month over month is measured.

The defense is being built where the agents run

That chain is also CrowdStrike's product roadmap. The firm's AI Detection and Response line, which monitors what agents actually do on endpoints rather than what prompts say, grew more than 79-fold in three quarters, with no dollar figure disclosed ³. On October 21 CrowdStrike extended its NVIDIA partnership to push Guardian enforcement toward the chip level, with that piece still planned rather than shipped ³⁴.

What the price already assumes

The stock closed October 21 at $239.34 after a 5% jump↗ on the NVIDIA▼−0.26% — NVIDIA, down 0.26 percent today news, trades at about 169 times forward earnings against Palo Alto at 83x, and the Street target sits near the price ³.

CEO George Kurtz sold 20,000 shares, about $4.7 million, under a pre-arranged January plan the same week ⁴. The NVIDIA tie-up is non-exclusive, with ten rivals on the same architecture ³.

The thesis now rests on one number

Nothing here says sell. It says the thesis now rests on one disclosed number: fiscal Q3 revenue is guided at $1.523 to $1.529 billion, and the early-December print, two weeks after this report, is the first chance for an AIDR dollar figure to confirm that documented threat is becoming paid-for defense ³. Until then, the threat is documented but the revenue is not.

If you run AI agents in your organization, the report is your to-do list regardless of the stock: know which agents exist, what they can touch, and who watches them. The attackers have shown the workflow works; the early-December print will show whether the watching layer is turning into revenue, and the companies that build it, whoever wins, are doing the work that matters.