Calm down. · Both
Calm down: the robot army runs on your credit card.
CrowdStrike published a report on Oct 21 about four threat actors running agentic intrusion campaigns: AI agents picking next steps and executing commands, not just drafting phishing copy. Some coverage flattened CrowdStrike's 12-month forecast into unskilled attackers matching nation-states. Calm down.
Read CrowdStrike's own framing first. On the public writeup, Counter Adversary Operations says agentic AI "commoditizes baseline offensive cyber operations," and that over the next 12 months some low-skill threat actors will likely reach "a level of effectiveness and scale previously only achievable by organized criminal groups or state-nexus actors." That is a forecast with confidence language, not a claim that yesterday's script kiddie is APT29. The four cases they open-sourced (by finding the operators' own exposed directories) include real compromises: Argentine healthcare entities, government domains, a U.S. CRM vendor's client data. They also include an Indonesian-speaking operator who had to keep intervening when Claude Code hit safety guardrails, and who leaned on 819 mostly public GitHub skills with almost no custom orchestration.
The line the doom posts skip is the limiter. Per CrowdStrike as quoted by Cybersecurity Dive, even the two actors on simple harnesses still broke into "numerous organizations," "demonstrating that the primary barrier to scaling an AI-orchestrated intrusion campaign is not engineering complexity but token budgets." Dive also reports CrowdStrike's data as pointing to roughly a threefold rise in likely agentic intrusions in H2 2026 versus H1, with August more than double July and September double August. And yes: Dive says CrowdStrike analysts wrote that the resulting campaigns will remain "riddled with amateur mistakes," even as "their sheer scale" makes the environment worse. Skill is not the scarce resource. Tokens are.
That is the practical upshot, and it rhymes with something defenders already own. If the attacker's ceiling is a token budget, your exposed model endpoint or stolen API key is how they raise it. We covered that pattern when Symantec's honeypot caught an LLMjacking agent shopping for open models (Your Exposed AI Endpoint Is Someone Else's Free Attack Bot). Same week, CISA and Canada's Cyber Centre published joint guidance (PDF / ITSM.00.125; CISA landing) on managing AI token consumption: unmanaged use can mean unpredictable cost, token exhaustion, and denial-of-tokens or denial-of-wallet attacks. Per the full guidance: prioritize token allocation, leverage caching and reusable context, monitor consumption, and plan for reduced AI availability. Attackers burn tokens. So do you. Cap both.
My take: agentic tooling lowers the floor for noisy, mistake-prone campaigns. It does not mint nation-state tradecraft out of a Claude subscription. The robot army still invoices someone. Make sure it is not you.
What to do:
- Authenticate every model and gateway endpoint. Why: stolen or open inference is how someone else spends on your account. How: require auth on model-listing and health paths too; bind Ollama, LM Studio, and local gateways to localhost or put them behind an authenticated proxy (same checklist as the LLMjacking brief).
- Cap spend and alert on spikes. Why: CrowdStrike says token budgets bound how far these campaigns scale; a sudden bill is often the first signal. How: hard caps and billing alerts per provider key, one key per tool or app.
- Treat a token or spend spike as an incident signal. Why: CISA's guidance flags denial-of-wallet and exhaustion as operational risks; LLMjacking looks the same from the billing side.
- Preserve provider usage logs and gateway access logs before you rotate.
- Check which keys, IPs, and models drove the spike.
- Contain by disabling the hot key and taking any public endpoint offline.
- Rotate every key that key could reach, then reissue with lower ceilings.
- Keep expecting amateur mistakes. Why: CrowdStrike's own cases include operators babysitting the model past refusals and relying on public skill packs. How: the usual detections still work — spray cadence, odd automation fingerprints, unexpected tool or shell children from agent frameworks. Do not wait for perfect OPSEC before you look.
Sources
- CrowdStrike: Uncovers New Agentic AI Campaigns (Oct 21, 2026)
- Cybersecurity Dive coverage of the CrowdStrike agentic campaigns report (Oct 22, 2026)
- Cyber Centre / CISA: Managing AI Token Consumption for Operational Resilience — ITSM.00.125 (PDF)
- CISA landing page (Oct 22, 2026)
- Dumb But Secure: Your Exposed AI Endpoint Is Someone Else's Free Attack Bot