--- title: "CrowdStrike says four hacking groups now run AI agents on their own; its AIDR line grew 79-fold" description: "CrowdStrike's threat-intelligence unit has documented four hacking groups running AI agents as autonomous operators. The same firm sells the detector, and the early-December fiscal Q3 print is the first dollar test of whether documented fear becomes disclosed revenue." publisher: "The Inference" section: "Security" published: 2026-10-23T17:14:29.510Z modified: 2026-10-23T17:14:29.510Z canonical: https://theinference.org/article/crowdstrike-says-four-hacking-groups-now-run-ai-agents-on-their-own-its-aidr-line-grew-79-fold language: en keywords: "CrowdStrike, Cybersecurity, AI Agents, Nvidia, Valuation" --- # CrowdStrike says four hacking groups now run AI agents on their own; its AIDR line grew 79-fold > CrowdStrike's threat-intelligence unit has documented four hacking groups running AI agents as autonomous operators. The same firm sells the detector, and the early-December fiscal Q3 print is the first dollar test of whether documented fear becomes disclosed revenue. AI agents are hacking on their own now, and [CrowdStrike](https://theinference.org/markets/companies/crowdstrike)'s December print has to price it. The firm's [October 22 threat report](https://www.cybersecuritydive.com/news/agentic-ai-cyberattacks-harnesses-crowdstrike/833714/) documents four hacking groups running AI agents that chose their own techniques and breached numerous organizations [1]. The same firm sells the detector, the stock jumped on [the same week's NVIDIA deal](https://theinference.org/article/crowdstrike-rose-6-to-241-02-as-security-stocks-jumped-8-on-an-nvidia-agent-deal-with-no-terms), and the early-December fiscal Q3 print is the first dollar test of whether documented fear becomes disclosed revenue [3][4]. The question about AI hacking just stopped being hypothetical. CrowdStrike's threat-intelligence unit published a report on October 22 documenting four hacking groups that ran AI agents as autonomous operators, not just as tools for writing phishing emails: in campaigns between May and August, agents chose techniques, pivoted between victim networks and solved problems their human handlers never scripted [1]. ## One agent supervised another in the Argentine healthcare breaches One Spanish- and English-speaking group breached at least 15 Argentine healthcare organizations and stole medical records, running one Claude Code agent as a supervisor over an executor agent [1][2]. What is new since [our last look at this trade, on October 16](https://theinference.org/article/citi-lifted-crowdstrike-to-295-on-the-vendor-s-own-ai-attack-reporting-october-31-is-the-test), is this report itself, plus confirmation that the fiscal Q3 print lands in early December rather than the October 31 date we had flagged as the test [1][2]. ## Token budgets, not skill, are now the constraint CrowdStrike's own line cuts deepest: for the two low-skill groups, "the primary barrier to scaling an AI-orchestrated intrusion campaign is not engineering complexity but token budgets" [1]. Read that as a demand curve. As inference costs fall, the constraint moves from skill to spend, and the firm logged a threefold rise in agentic intrusions in the second half of 2026, with September double August [1]. The attackers used older Claude and open-weight [DeepSeek](https://theinference.org/markets/companies/deepseek) models, [exploited uneven guardrails across models](https://www.ndtv.com/world-news/cybercriminals-bypass-ai-guardrails-to-boost-cyberattacks-says-crowdstrike-12224490), and needed no novel exploits, only speed and volume against unpatched, ordinary weaknesses [2]. Unskilled hackers matching nation-state technique within twelve months is a forecast, but the doubling month over month is measured. ## The defense is being built where the agents run That chain is also CrowdStrike's product roadmap. The firm's AI Detection and Response line, which monitors what agents actually do on endpoints rather than what prompts say, grew more than 79-fold in three quarters, with no dollar figure disclosed [3]. On October 21 CrowdStrike [extended its NVIDIA partnership](https://theinference.org/article/crowdstrike-puts-safemind-on-nvidia-s-stage-while-check-point-patches-its-own-exploited-9-8s) to push Guardian enforcement toward the chip level, with that piece still planned rather than shipped [3][4]. ## What the price already assumes The stock [closed October 21 at $239.34 after a 5% jump](https://finance.yahoo.com/markets/stocks/articles/crowdstrike-stock-rose-5-expanded-195738995.html) on the [NVIDIA](https://theinference.org/markets/companies/nvidia) news, trades at about 169 times forward earnings against Palo Alto at 83x, and the Street target sits near the price [3]. *Chart: **CrowdStrike trades at roughly twice the forward multiple of its closest peers** Bar chart comparing next-twelve-month normalized P/E ratios: CrowdStrike 169, Palo Alto Networks 83, Fortinet 50, Zscaler 47.* *Next-twelve-month normalized P/E multiples as of October 21, 2026, per TIKR via Yahoo Finance. [3]* CEO [George Kurtz](https://theinference.org/markets/people/george-kurtz) sold 20,000 shares, about $4.7 million, under a pre-arranged January plan the same week [4]. The NVIDIA tie-up is non-exclusive, with ten rivals on the same architecture [3]. ## The thesis now rests on one number Nothing here says sell. It says the thesis now rests on one disclosed number: fiscal Q3 revenue is guided at $1.523 to $1.529 billion, and the early-December print, two weeks after this report, is the first chance for an AIDR dollar figure to confirm that documented threat is becoming paid-for defense [3]. Until then, the threat is documented but the revenue is not. *Chart: **Nine straight quarters of growth, and the guide asks for $1.52B to $1.53B next** Line chart of CrowdStrike quarterly revenue rising from $0.96 billion in the quarter ended July 2024 to $1.47 billion in the quarter ended July 2026, with a guided range of $1.523 to $1.529 billion for the fiscal quarter ending October 31, 2026.* *CrowdStrike quarterly revenue in USD billions, as reported in SEC filings. Q3 '26 is the fiscal quarter ending October 31, 2026, guided at $1.523 to $1.529 billion and reporting in early December. [5]* If you run AI agents in your organization, the report is your to-do list regardless of the stock: know which agents exist, what they can touch, and who watches them. The attackers have shown the workflow works; the early-December print will show whether the watching layer is turning into revenue, and the companies that build it, whoever wins, are doing the work that matters. ## Takeaway CrowdStrike's October 22 report documents four hacking groups running AI agents as autonomous operators, and agentic intrusions tripled in the second half of 2026; the same firm sells the detector, and its early-December fiscal Q3 print, guided to $1.523 to $1.529 billion, is the first dollar test of whether that fear becomes revenue. ## Sources 1. [Cybersecurity Dive, Agentic AI helps hackers level up, even without detailed instructions, 22 October 2026](https://www.cybersecuritydive.com/news/agentic-ai-cyberattacks-harnesses-crowdstrike/833714/) 2. [NDTV, Cybercriminals Bypass AI Guardrails To Boost Cyberattacks, Says CrowdStrike, 22 October 2026](https://www.ndtv.com/world-news/cybercriminals-bypass-ai-guardrails-to-boost-cyberattacks-says-crowdstrike-12224490) 3. [Yahoo Finance/TIKR, CrowdStrike Stock Rose 5% as It Expanded Its NVIDIA AI Security Deal. Here's Where the Stock Could Go by 2031, 22 October 2026](https://finance.yahoo.com/markets/stocks/articles/crowdstrike-stock-rose-5-expanded-195738995.html) 4. [Traders Union, CrowdStrike rises 4.05% today on rebound, 23 October 2026](https://tradersunion.com/news/stocks/show/3912407-crowdstrike-rises-4-05percent-today-on/) 5. [CrowdStrike, quarterly figures from its SEC filings, retrieved 23 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001535527) --- CrowdStrike says four hacking groups now run AI agents on their own; its AIDR line grew 79-fold — The Inference. Canonical: https://theinference.org/article/crowdstrike-says-four-hacking-groups-now-run-ai-agents-on-their-own-its-aidr-line-grew-79-fold