CrowdStrike report: AI is rewriting rules of cybersecurity

Ah, splendid. CrowdStrike's new report has arrived to inform us that AI is 'rewriting the rules of cybersecurity,' which is corporate jargon for: the bastards are now stealing the keys to the very models we were told would save us. Threat actors are nicking credentials for commercial AI models, hijacking enterprise AI resources and racking up someone else's computing bill. CrowdStrike has even coined two charming names for these activities: 'LLM jacking' and 'cost harvesting.' Nothing says 'we have taken full control of the situation' like inventing cute portmanteaus for people emptying your GPU budget.

Let's pause to appreciate the grift. The same companies that have spent the past two years telling us their AI is a portal to infinite productivity have built infrastructure so welcoming that outsiders can move in and turn on the heating without paying. Credentials for commercial AI models are being stolen, enterprise AI resources are being hijacked, and the only new security measure appears to be a report describing it afterwards. But the real punchline — and there is always a real punchline — is the news that AI-assisted research is shortening the time between vulnerability disclosure and real-world attacks. So the tools we let through the front door are now helping intruders reach the server room faster — after all, why spend weeks reverse-engineering a system when the AI can do it before lunch?

One wonders whether the cybersecurity industry is quietly delighted by this development. CrowdStrike, a firm that sells protection, has just published a report effectively proving that the threat surface has expanded to include every chat assistant and model API your company bought last quarter. That's not a warning; that's a marketing campaign. The rules of cybersecurity are indeed being rewritten — by the attackers, with our own credentials, on our own compute. And the rest of us get to pay the bill and call it progress.