Online security firm CrowdStrike revealed the extent of the trend on Tuesday in a report into online threats, which found AI agents were triggering more than twice as many attacks as humans.
The findings come after the Australian Energy Market Operator warned the nation's power grid was vulnerable to AI-powered attacks, and after the Five Eyes security agencies advised organisations to strengthen their defences against AI.
CrowdStrike's 2026 Threat-Hunting Report analysed online attacks launched during the past year, in addition to closely monitoring more than 290 criminal, nation state and hacktivist groups.
It found attacks using artificial intelligence spiked by 89 per cent during 2025 as groups increased the volume and speed of their intrusion efforts.
Attacks triggered by AI agents were 2.5 times more common than those from humans over the past year, the report found, and AI-powered threats were shrinking the time between a criminal breaking into a computer system and spreading to more devices.
The breakout window could now be measured in hours rather than days, CrowdStrike counter adversary operations senior vice-president Adam Meyers said, and just minutes in some cases.
"Things are going to get a lot faster and that's probably the scary part here," he said.
"Look at our global threat report where we saw … the speed increase of the adversary, on average, went from 48 minutes to 29 minutes, with 27 seconds being the fastest one."
Between January and June, most software vulnerabilities were being exploited within 48 hours of confirmation (88 per cent), the report found, and some hacking groups were launching attacks within 24 hours.
AI would shrink that window even further in future, Mr Meyers said, and could be used to attack weaknesses in legacy systems such as those in critical infrastructure.
"AI is certainly being used to find vulnerabilities in these types of systems and it could be a problem," he said.
"That depends on what systems they're using and how they're configured."
The findings come after the Australian Energy Market Operator, which runs the National Electric Market, warned national electricity systems were at growing risk from AI-powered attacks.
"Critical infrastructure sectors, including energy, are particularly exposed to AI-enabled cyber threats because of complex operating environments, legacy systems and interconnected supply chains," the report said.
"Lower barriers to entry mean that poorly secured or legacy systems may become more attractive targets to increasingly capable threat actors."
Energy service providers and suppliers should ensure their defences are capable and have been tested, the report said, and that older systems are patched quickly.
14°C