Framework development aims to accelerate Thailand’s readiness for commercial AAM operations.

MELBOURNE, Fla., Aug. 17, 2026 – Eve Air Mobility (NYSE: EVEX, EVEXW; B3: EVEB31) and RV Connex Co., Ltd., a leading Thai engineering and aerospace company, are signing a Memorandum of Understanding (MOU) to work together on regulatory development that will help shape Thailand’s Advanced Air Mobility (AAM) industry.

Under the terms of the MOU, RV Connex and Eve will jointly collaborate on long term industry and regulatory engagement in Thailand. Bringing together interested public and private stakeholders to establish safe, efficient, and scalable advanced air mobility operations.

“Thailand offers a fantastic opportunity for urban air mobility. Working with RV Connex lets us help shape the regulations this industry needs to grow,” said Johann Bordais, chief executive officer at Eve Air Mobility. “This MOU shows our strong commitment to building the needed regulatory and operational foundations together with local partners.”

This collaboration seeks to evaluate future operational scenarios, safety requirements, airspace rules, and infrastructure needs that are specific to Thailand’s aviation system. Learning from global AAM standards while also meeting the needs of the Thai market. RV Connex will collaborate closely with partners from government, academia, and industry to make sure the process is thorough and inclusive.

“RV Connex wants to help make Thailand a leader in global advanced air mobility,” said Sujate Jantarang, president of RV Connex. “Our MOU with Eve Air Mobility and our partners will create a strong framework to help Thai authorities develop modern, globally aligned regulations for this new technology.”

Images : RV Connex Eve 100 Aircraft

About Eve Air Mobility

Eve Air Mobility is dedicated to accelerating the Urban Air Mobility (UAM) ecosystem. Benefitting from a start-up mindset, backed by Embraer’s 56-year history of aerospace expertise, and with a singular focus, Eve is taking a holistic approach to progressing the UAM ecosystem, with an advanced eVTOL project, comprehensive global services and support network and a unique air traffic management solution. Eve is listed on the New York Stock Exchange (EVEX; EVEXW) and the São Paulo Stock Exchange (EVEB31), where its shares of common stock, public warrants and Brazilian Depository Receipts are traded. For more information, please visit www.eveairmobility.com.

About R V Connex

RV Connex Co., Ltd. is a Thai aerospace and advanced technology company specializing in the research, development, and manufacturing of next-generation aviation and autonomous systems. The company brings full-stack expertise in unmanned aerial systems, aircraft engineering, and integrated operational command and control, supported by a sovereign capability to design, build, and sustain complex aerospace platforms in Thailand. With proven know-how spanning airframe development, mission systems integration, and the operational architectures that govern safe and coordinated flight, RV Connex partners with leading technology companies to advance the future of aviation and urban air mobility. These capabilities are reinforced by an established cybersecurity practice that ensures the integrity and resilience of connected aerospace systems.

Contact

Eve Air Mobility: [email protected]

Forward-Looking Statement Disclosure

Certain statements contained in this release are forward-looking statements within the meaning of the U.S. Private Securities Litigation Reform Act of 1995. These forward-looking statements may be identified by words such as “may,” “will,” “expect,” “intend,” “anticipate,” “believe,” “estimate,” “plan,” “project,” “could,” “should,” “would,” “continue,” “seek,” “target,” “guidance,” “outlook,” “if current trends continue,” “optimistic,” “forecast” and other similar words or expressions. All statements, other than statements of historical facts, are forward-looking statements, including, but not limited to, statements about the company’s plans, objectives, expectations, outlooks, projections, intentions, estimates, and other statements of future events or conditions, including with respect to all companies or entities named within. These forward-looking statements are based on the company’s current objectives, beliefs and expectations, and they are subject to significant risks and uncertainties that may cause actual results and financial position and timing of certain events to differ materially from the information in the forward-looking statements. These risks and uncertainties include, but are not limited to, those set forth herein as well as in Part I, Item 1A. Risk Factors and Part II, Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations of the company’s most recent Annual Report on Form 10-K, Part I, Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations and Part II, Item 1A. Risk Factors of the company’s most recent Quarterly Report on Form 10-Q, and other risks and uncertainties listed from time to time in the company’s other filings with the Securities and Exchange Commission. Additionally, there may be other factors of which the company is not currently aware that may affect matters discussed in the forward-looking statements and may also cause actual results to differ materially from those discussed. The company does not assume any obligation to publicly update or supplement any forward-looking statement to reflect actual results, changes in assumptions or changes in other factors affecting these forward-looking statements. other than as required by law. Any forward-looking statements speak only as of the date hereof or as of the dates indicated in the statement.

AI is changing from a tool that generates content into agents that reason, decide, and take autonomous action. Employees now use AI assistants in their browsers and desktop apps. Developers run coding agents that read files and execute commands on their machines. Business teams build agents and connect them to enterprise data through Model Context Protocol (MCP) servers.

This shift from asking AI to tasking AI creates hard questions for security teams: Which AI agents are operating in the environment? Who deployed them? What can they access? What are they doing?

Since CrowdStrike Falcon® Guardian launched on September 1, 2026, it has been deployed at hundreds of organizations around the world spanning financial services, healthcare, manufacturing, retail, energy, and the public sector.

We asked what led them to Falcon Guardian; their answers fell into five themes listed below.

1. Visibility is the top priority

For most organizations, the first challenge was visibility. Security leaders knew AI use was widespread but lacked a view of which agents and tools were in use, what data was going into prompts, and which tools were sanctioned versus shadow AI.

Falcon Guardian discovers AI use across endpoint, cloud, and SaaS environments spanning agents, tools, MCP servers, and more. In early deployments, various organizations deploying Falcon Guardian reported:

Hundreds of AI interactions their existing controls hadn't recorded

Over 260 distinct AI services in use at a single organization

Confidential documents and customer records being shared with public AI chatbots

Every modern organization has a shadow AI challenge if they have not deployed an AI detection and response (AIDR) solution. With the discovery and visibility that Falcon Guardian provides, security teams can set policy based on how AI is used across their organization.

How long does it take Falcon Guardian to achieve this visibility in an environment? Only a few minutes for customers who have already deployed the CrowdStrike Falcon® sensor and licensed Falcon Guardian. Multiple customers deployed Falcon Guardian live in their production environments while participating in workshops at Fal.Con 2026 in Las Vegas and saw visibility immediately during the workshop.

Figure 1. Falcon Guardian’s honeycomb dashboard that gives teams an organizational view of agents deployed on endpoints

2. AI executes on the endpoint

AI agents run on laptops, workstations, and servers. They act through the same processes, files, and user permissions that the Falcon platform already protects. Falcon Guardian extends the Falcon platform's runtime security into the agentic layer. It works through the Falcon sensor and console that organizations already use, and also leverages the Falcon browser extension.

Many organizations told us this was the deciding factor: CrowdStrike’s endpoint strength where agents execute. Tools that rely on inspecting network traffic or discrete integrations with each agent via hooks can't connect an agent's AI activity to the system actions it triggers. Falcon Guardian links AI telemetry with endpoint telemetry so security teams can see what an agent was asked to do, what it actually did on the endpoint, and how those actions affected enterprise systems.

In the words of one CISO, CrowdStrike is "uniquely positioned" because it is already on the endpoint.

Figure 2. Graphical representation of the agent telemetry and OS telemetry that are combined within Falcon Guardian

3. Agents are the new insider threat

Workforce AI adoption in the browser started this AI revolution. Now, AI agents are moving it forward quickly and independently in many cases, as evidenced by recent lab containment breaches where agents have escaped their sandbox and attacked other organizations. Organizations are adopting coding agents, desktop AI apps, and internally built agents faster than most security teams can inventory them.

In one customer evaluation, Falcon Guardian discovered two internally built agents that the security operations team didn't know were running. Another organization used Falcon Guardian to gain visibility into MCP activity across its environment and detect risky data and instructions passing between agents and MCP servers. The security challenge of agentic misalignment is real and expanding with agent adoption. In one instance, the CrowdStrike Falcon® Adversary OverWatch threat hunting team observed an endpoint agent attempt to use public data-sharing websites as a "convenient and fast" method to share corporate IP files to fulfill its objective.

Discovery is the first step. From there, security teams can decide which supported agent types are allowed to run, enforce runtime guardrails to align agents to governance policy, investigate agent activity in the Falcon console, and respond when an agent behaves in unexpected ways.

Figure 3. The Falcon Guardian threat score given to an endpoint with additional information relating to detections and other relevant data

4. Falcon Guardian is proven in testing

Organizations are evaluating AI security rigorously, often with test suites they build themselves. Falcon Guardian's detection draws on CrowdStrike's prompt injection taxonomy, which covers more than 200 techniques. In customer-run evaluations:

A financial services firm measured 99% detection accuracy on prompt injection

A global telecommunications company measured 95%+ average block rates across malicious prompt categories, with 98%+ multilingual coverage

Beyond detection, Falcon Guardian helps keep sensitive data from reaching third-party models. Policies can detect, redact, or block personal and confidential information in supported AI interactions. Access and content controls can be applied by user, application, and other attributes.

5. Businesses are saying yes to AI

The organizations adopting Falcon Guardian are expanding AI. Many are rolling out enterprise AI assistants, coding agents, or internally built agents. Their executives and boards want guardrails in place first.

For these organizations, Falcon Guardian has become an essential part of the rollout plan. One organization made Falcon Guardian a requirement before deploying an AI assistant to more than 20,000 employees. Other customers needed to show how AI use is governed in response to requirements such as HIPAA, DORA, NIS2, and the EU AI Act.

Because Falcon Guardian is part of the Falcon platform, organizations can add it to their existing CrowdStrike deployment. Its findings flow into CrowdStrike Falcon® Next-Gen SIEM, so AI activity can be investigated alongside endpoint, identity, SaaS, and cloud data.

Secure AI Where It Executes

These organizations faced different AI programs and different pressures, but they arrived at the same needs. They need to discover AI agents and understand where risk is concentrated. They need to connect AI activity with endpoint execution to investigate and stop AI threats. They want one platform for AI visibility, governance, runtime protection, and response, starting at the endpoint and extending across cloud and SaaS environments.

Falcon Guardian helps organizations adopt AI securely and keep innovating with confidence.

To exploit these vulnerabilities, attackers must adapt the POC exploit for the specific PHP version and application (e.g., WordPress). This adaptation presents a meaningful barrier to would-be threat actors, as it requires the exploit developer to know and use the same versions of Docker containers, packages, and other elements used by targeted applications.

At this time, CrowdStrike Counter Adversary Operations has not observed successful exploitation of these vulnerabilities in the wild or within our honeypot environments. Additionally, we have not identified any fully weaponized exploit, or any POC exploit, sufficient to widely achieve applicable exploitation. Despite the attention PHP2Shell is receiving, only testing, probing, and unsuccessful exploitation attempts have been observed at this time. 

Threat actors have several viable alternative vulnerabilities capable of achieving unauthenticated RCE against many applications that use PHP reliably and at scale. Many opportunistic threat actors may currently favor proven effective exploits and other attack vectors as they are not able to successfully leverage PHP2Shell in the near term.

CVE-2026-109618 and CVE-2026-109619 Overview 

On October 21, 2026, PHP disclosed CVE-2026-109618 and CVE-2026-109619, which affect the following versions:

- Earlier than 8.2.35

- Earlier than 8.3.36

- Earlier than 8.4.27

- Earlier than 8.5.12

Preliminary analysis by industry sources and the vendor suggests many older versions, including end-of-life PHP versions, are also impacted by these vulnerabilities and may receive limited patches to fix them.

CrowdStrike Counter Adversary Operations reproduced a POC exploit achieving RCE with the privileges of the running mod_php or the PHP-FPM worker processes, both of which should be unprivileged in most cases, as dictated by the least privileges principle.

Understanding PHP Workers and Request Handling 

A PHP worker is a long-running process that executes PHP requests. Instead of starting a new PHP interpreter for every HTTP request, the server reuses workers to reduce startup overhead. Under normal conditions, request-specific data is initialized when a request begins and released when it ends, while process-level state persists for the worker's lifetime. Consequently, two unrelated requests may be handled sequentially by the same worker. This distinction is critical for cross-request vulnerabilities: Memory left in an inconsistent state by one request may affect a subsequent request only if the request reaches the same persistent worker.

mod_php and PHP-FPM are the two most common PHP deployment and web server integration models. They use different server APIs (SAPIs), which define how the PHP engine receives and processes web requests.

With mod_php, PHP is loaded directly into Apache as a module, and PHP code executes within Apache worker processes.

With PHP-FPM, PHP runs as a separate service composed of a master process and a pool of workers. A web server such as Apache or Nginx forwards requests to these workers using the FastCGI protocol, typically through a Unix socket or a TCP connection.

In both models, workers are reused across multiple requests. This reuse is relevant to vulnerabilities that leave a corrupted or stale state behind for subsequent requests.

During technical analysis of CVE-2026-109618 and CVE-2026-109619, CrowdStrike Counter Adversary Operations identified three distinct flaws that, if exploited, can enable RCE. 

CVE-2026-109618 aligns with the partial hashTable insertion flaw, and CVE-2026-109619 aligns with the persistent serialization-context use-after-free and session-global use-after-free flaws.

CVE-2026-109618 Partial HashTable Insertion

PHP uses HashTable structures internally to store collections of key-value pairs, including arrays and HTTP request variables. Each stored entry is represented by a bucket, which contains the value together with information such as the value’s key and type. PHP uses the HashTable’s entry count to determine which buckets contain valid data and must be processed or released.

The vulnerability stems from a memory corruption during HTTP request-variable parsing. If a memory allocation fails while PHP is adding a new HashTable entry, the entry count may be updated before the corresponding bucket is fully initialized. During request shutdown, PHP may then treat this incomplete bucket as valid and attempt to access or release invalid data. This can result in an invalid memory access, memory corruption, or termination of the PHP process, potentially leading to execution of arbitrary code.

CVE-2026-109619: Persistent Serialization-Context Use-After-Free

PHP’s serialize() function converts a PHP value, such as an array or object, into an encoded string that can be stored or transmitted. The corresponding unserialize() function reconstructs the original PHP value from that string. While these operations are running, PHP maintains an internal serialization context to track objects, references, and recursive data structures.

zend_bailout(), PHP’s internal emergency mechanism for stopping execution after a fatal error, immediately transfers control to a recovery point, so normal function returns and cleanup code may be skipped unless they are handled explicitly.

PHP contains a cross-request use-after-free vulnerability in its serialization-context handling. If a fatal error causes zend_bailout() to interrupt serialize() or unserialize(), PHP may leave the internal context pointing to memory owned by the current request. That memory is released when the request ends, but the PHP worker may remain alive and retain the stale pointer. A later request handled by the same worker may then access or modify the released memory. Based on the configuration, successful exploitation may allow an attacker to disclose memory, crash the PHP worker, or execute arbitrary code.

CVE-2026-109619: Session-Global Use-After-Free

PHP’s session upload-progress feature allows an application to monitor a file upload’s progress. When enabled, PHP detects a specific field in a multipart or form-data request and creates a temporary progress record in the user’s session before the PHP script begins executing. As upload data arrives, PHP periodically opens the session, updates the number of processed bytes, writes the session data, and releases the session lock. When the upload finishes or is cancelled, PHP removes the progress record and clears the related internal state.

PHP contains a cross-request use-after-free vulnerability in the session upload-progress life cycle. If a fatal error interrupts multipart request processing before upload-progress cleanup finishes, PHP may skip the code that normally closes the session and clears its internal state. The current request’s memory is then released, but the persistent PHP worker may still retain pointers to that memory. A later request handled by the same worker may access or modify the released memory. 

Depending on the configuration, successful exploitation may cause memory disclosure or corruption, crash the PHP worker, leave a session lock permanently held, or make the affected service unavailable.

Assessment

Exploit developers are unlikely to create a single universal exploit that works reliably across all affected PHP deployments. The creation of a POC exploit capable of reliable remote exploitation is feasible, however, against specific deployment profiles, such as a fixed Docker image or a known combination of PHP, libc, SAPI, and web application versions. For such cases, an attacker can calibrate exploit offsets and heap grooming in advance, producing an exploit that reliably applies to any system running that same unmodified package or image release.

In the short to long term, advanced threat actors will likely attempt to exploit this vulnerability against high-value targets where alternative exploitation methods are less feasible. However, if a public exploit overcoming the aforementioned exploitation challenges becomes available for a widely used PHP deployment, many additional threat actors will almost certainly seek to leverage it immediately. 

The widespread media and industry attention surrounding this vulnerability will almost certainly incentivize both threat actors and security researchers to discover additional PHP vulnerabilities in the short to long term. 

Although threat actors have not yet successfully exploited PHP2Shell, the rapid speed with which they attempted to weaponize these vulnerabilities highlights how swiftly attackers integrate new exploits into their operational capabilities, frequently aided by public research from industry sources. This trend, combined with the recurring pattern of vulnerability discovery, rediscovery, and patch circumvention, which is currently accelerated by AI-assisted vulnerability research, underscores the critical necessity for organizations to remain vigilant in patching and hardening their environments against emerging threats.

Recommendations

These recommendations can be implemented to help protect against the activity described in this report:

- Patch all applications using PHP to the latest version as soon as possible, prioritizing the patching of internet-facing applications

- Rebuild container images and restart all Apache and PHP-FPM workers after deployment to remove any stale process state

- Disable session upload progress (via session.upload_progress.

Cyber intrusions targeting the legal sector nearly doubled between 2023 and 2026, reflecting the value of legal entities to both eCrime and nation-state adversaries. Legal entities hold privileged communications, corporate transactions, intellectual property, government matters, and financial records that make them valuable targets for threat actors seeking financial gain or long-term strategic intelligence.

The CrowdStrike 2026 Legal Threat Landscape Report analyzes threat activity observed from September 1, 2025 through August 31, 2026. It includes the key themes, trends, and events shaping the legal sector threat landscape, as well as anticipatory assessments and actionable recommendations to help the sector prepare for the continued evolution of modern threats.

The breadth and complexity of threats targeting the legal sector are evident in this analysis. As AI technology advances, adversaries are likely to accelerate the scale and sophistication of their operations, putting greater pressure on defenders. This evolving environment demands continuous intelligence-driven defense to detect and stop threats.

eCrime Makes Up 82% of Threats to Legal Entities

Financially motivated adversaries accounted for 82% of observed activity against the legal sector. They can profit from attacks on legal entities by deploying ransomware or monetizing stolen data through extortion or resale on criminal markets. Big game hunting adversaries named 455 legal entities on dedicated leak sites, a 39% year-over-year increase.

CHATTY SPIDER is a dominant threat: Their activity surged 129% in the first eight months of 2026 compared to all of 2024, and law firms made up nearly 90% of their victims during the reporting period. The adversary typically resumes data theft and extortion campaigns following a mid-year hiatus; however, they returned from this break slightly earlier than usual in 2026.

This adversary almost exclusively targeted U.S.-based law firms, a trend highly likely to continue. They manipulate victims by impersonating IT staff to establish remote access sessions and exfiltrate sensitive data within minutes, and they increasingly use trusted enterprise tools to do it.

In November 2025, CHATTY SPIDER hired a Russian national to physically access a U.S.-based law firm. The individual posed as an internal IT employee and was granted access to an onsite workstation, where he enabled the adversary to deploy remote monitoring and management (RMM) tools and attempted to exfiltrate data via cloud storage services. While the individual was detained during a second attempted visit, public reporting indicates CHATTY SPIDER used U.S.-based individuals to conduct several physical intrusions during 2026.

SNARKY SPIDER, which emerged in October 2025, and CORDIAL SPIDER, which emerged in November 2025, are both significant eCrime threats to the legal sector. Both have targeted legal entities in high-tempo data theft and extortion campaigns. They share nearly identical tactics, techniques, and procedures (TTPs), including vishing calls that impersonate IT personnel and directing employees to single sign-on (SSO)-themed phishing pages. In one case, both targeted the same law firm one month apart.

China-Nexus Adversaries Intensify Espionage Operations

Multiple China-nexus adversaries conducted sustained cyber espionage campaigns against the legal sector throughout the reporting period. They demonstrated evolution across three key areas: zero-day exploitation of enterprise infrastructure, sophisticated cloud environment compromise, and targeted exploitation of legal-specific software.

The top China-nexus adversaries targeting the legal sector are WARP PANDA, TITAN PANDA, MURKY PANDA, and OVERCAST PANDA. Below is a snapshot of their activity:

WARP PANDA: Multiple intrusions at U.S.-based entities included targets in the legal sector. WARP PANDA deployed several forms of malware in victims’ VMware vCenter environments. In several of these cases, and as late as early 2026, the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day.

TITAN PANDA: In April 2026, TITAN PANDA conducted the first observed targeting of legal sector-specific software. The adversary exploited a hardcoded IIS machine key vulnerability in Intapp Time Server, software almost exclusively used by law firms for timekeeping and billing.

MURKY PANDA: This adversary’s ORB28 password spraying campaign, while slightly outside the reporting period, represented the largest-scale operation by target count. The campaign affected more than 340 primarily U.S.-based entities across numerous sectors; the legal sector was the most affected. One law firm experienced nearly 500 distinct failed login attempts to as many accounts from approximately 300 distinct IP addresses in a 30-day period.

OVERCAST PANDA: In September and October 2025, OVERCAST PANDA targeted executive-level employees at a U.K.-based legal firm, which is consistent with Chinese intelligence collection priorities targeting key personnel with access to sensitive information and decision-making authority.

Keeping Pace with the Adversary

CrowdStrike Counter Adversary Operations, which tracks more than 290 named adversaries, combines threat intelligence, managed threat hunting, and trillions of telemetry events from the CrowdStrike Falcon® platform to detect and stop threat actors.

Counter Adversary Operations comprises two integrated teams. The CrowdStrike Intelligence team provided the analysis for the CrowdStrike 2026 Legal Threat Landscape Report; this team identifies new adversaries, tracks malicious activity, and captures emerging cyber threat developments in real time. The CrowdStrike OverWatch team applies this intelligence through proactive threat hunting across customer telemetry to detect and disrupt malicious activity.

Together, these teams deliver intelligence and hunting capabilities to help legal sector organizations stay ahead of advanced adversaries and stop their attacks.

Additional Resources

- Learn more about CrowdStrike Counter Adversary Operations threat intelligence and threat hunting, or request a demo.

- Tune in to the Adversary Universe podcast, where CrowdStrike reveals the threat actors behind the latest cyberattacks.

CrowdStrike researchers asked a frontier AI model to explain a function in a small C web server. While it had previously explained every other function in the codebase without hesitation, it refused to explain this one.

The request was routine. We'd only asked what the code does; we hadn't asked about security, exploits, or vulnerabilities. But a single token in the code had changed: a max swapped for a min; a one-character logic inversion that creates an out-of-bounds write. It's the kind of bug that slips past code review and that pattern-matching scanners routinely miss.

The model never said there were any vulnerabilities, but its refusal to explain the function indicated there could be one. The act of the model changing behaviors on a specific chunk of code showed us exactly where to look for the vulnerability. Its guardrails became the giveaway.

That moment changed how we think about AI safety. The guardrails frontier labs build to keep models from helping attackers can't work without first recognizing that something is dangerous. This recognition is a signal that practitioners can read. Most of the industry treats refusals as a dead end; at CrowdStrike, we started treating them as findings.

We call this approach Guardrail-based Vulnerability Discovery (GbVD). In controlled tests across five vulnerability classes, it was correct in 73 of 86 test scenarios, and it held up on real open-source projects we disclosed through our Coordinated Vulnerability Disclosure (CVD) program.

Safety and capability are usually framed as a trade-off. This research suggests the opposite: Every improvement labs make to their guardrails also sharpens a methodology that cybersecurity practitioners or adversaries can use. This work builds on our earlier research into LLM safety classifiers, where we studied how those guardrails can be bypassed. Here, we look at the other side: what guardrails reveal when they work as intended.

Breaking Down Guardrail-based Vulnerability Discovery

Today, the most visible manifestation of a guardrail is a refusal: The model declines in plain text (or with “reason: cyber” in standard APIs), which makes the signal trivially readable. But refusals are just one observable among several. Guardrails in deployed AI systems take many forms, and most of them leak:

- Explicit refusals: The current dominant case, and the one our experiments exploit.

- Model downgrading: Some platforms route sensitive requests to a smaller or more conservative model. The routed response betrays itself through measurable differences: response latency, tokens spent, time-to-first-token, or a sudden drop in output specificity and style.

- Output filtering and truncation: A post-hoc filter that redacts or cuts off a response changes its length and shape in detectable ways.

- Reasoning interruption: In agentic settings, a guardrail may abort a tool call or halt a chain of reasoning mid-task rather than emit any refusal text at all (we observe this in our second case study).

Whatever form the guardrail takes, triggering it perturbs some measurable property of the response, such as content, timing, token count, or structure. The defender doesn't need the model to say anything explicitly; rather, they need only to measure the perturbation. Our experiments below use refusals because they are today's loudest channel, but the methodology is agnostic to how the guardrail manifests.

A binary, localized signal composes naturally with classic techniques, including bisection: split a codebase or filesystem into halves, ask the model to explain each half, and recurse into whichever half triggers the guardrail. The model never has to say "this is vulnerable"; it only has to behave differently in the right place.

Table 1 summarizes our experiments.

Prompt injection started as a simple idea during its initial chatbot phase: Tell the model to ignore its instructions and return information in violation of its guardrails. Now, prompt injection attacks can aim at something harder to see: how an agent plans, and how a model reasons and decides which rules apply.

The CrowdStrike Prompt Injection Taxonomy, built and maintained by CrowdStrike AI security researchers, offers the industry’s most comprehensive framework for understanding and defending against the ever-expanding array of attack techniques. Today we are introducing a new version of the taxonomy that adds newly discovered attack techniques on autonomous agents and how they plan. This expands the public taxonomy to 222 techniques.

How Adversaries Manipulate Agent Planning

An agent breaks its goal into steps, picks tools, and executes. An attacker no longer needs to get one forbidden request past an input or output filter in order to manipulate the agent. Attackers can shape the context the agent plans from, so a restricted action looks like the logical next step. Because each step can look benign on its own, defenses that check steps in isolation may miss what the plan adds up to.

Consider the following hypothetical scenario: A developer may ask their endpoint coding agent: "The integration tests keep failing. Figure out why and get them passing." A recently updated open source test utility was manipulated by an attacker to print a "troubleshooting" message when tests fail. It says environment drift is the usual cause, and the fix is to collect local config files and submit them to a "diagnostics endpoint" for comparison.

In this scenario, no one has told the agent to exfiltrate anything. The attacker's text reads as a troubleshooting procedure, so the agent folds that into its own plan. Sending local config files, including credentials, to an outside server becomes a step that it believes the goal requires. Each action looks normal by itself: Reading .env is routine debugging, and an HTTP request is routine patch-fetching. The risk only shows when you look at the whole sequence.

The latest taxonomy documents two new methods to achieve this attack:

- Goal Decomposition Exploitation subverts how an agent breaks a goal into sub-tasks; for example, by adding a malicious task or changing what a step does, so the agent concludes that a restricted action like exfiltrating a file is required. As in the example above, the goal of the agent was to debug the failing tests. The step of sending the config file to the “diagnostics endpoint” was the exfiltration.

- Constraint-Driven Task Steering uses environmental constraints or triggers to block an agent's usual route, so the fallback plan the agent picks is the path the attacker wanted all along. In the example above, if the agent was able to immediately know what was wrong with the local config or why the tests were failing, the agent would not have needed to send the config file to the “diagnostics endpoint” for comparison.

If you build or secure agentic applications, the takeaway is that agent security must include securing the plan, not only the prompt or LLM response.

Other new techniques in the Prompt Injection Taxonomy are:

- Output Exclusion Prompting covers attacks that ban the language tied to safety tuning, such as refusal templates or hedging.

- Session State Spoofing injects a fake system summary, such as a compaction note or memory log, that presents false facts or an approval that was never given as verified history. It matters most for systems that compact context or keep agent state logs.

Classifying Attacks by Reasoning Pipeline Stage

The new taxonomy also organizes attack techniques by the phase of the processing pipeline and attack targets. This lets defenders ask not just what an attack does, but where it interferes.

CrowdStrike OverWatch identified a VAPOR PANDA campaign using ARTEX alongside the Chinese-developed DeepSeek large language model (LLM) and a second commercial LLM to conduct intrusions against multiple high-value targets in parallel.

Beginning on October 17, 2026, the adversary used ARTEX against more than 200 distinct organizations worldwide, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions.

The VAPOR PANDA campaign detailed in this blog post is separate from the ARTEX activity recently reported by industry sources under the Storm-0940 designation.1 CrowdStrike has previously documented ARTEX and similar agentic frameworks in use by financially motivated and unattributed actors; in this campaign, a targeted intrusion adversary used ARTEX to run parallel intrusions against multiple high-value targets. CrowdStrike Falcon telemetry also revealed details absent from public ARTEX reporting, including VAPOR PANDA's deployment of the BLOODALCHEMY backdoor and its command-and-control (C2) infrastructure.2

This campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator. The operation also shows the adversary building endpoint sensor evasion directly into their agentic workflow, including instructions to identify hosts without the CrowdStrike Falcon sensor.

Details

Targeting

Beginning October 17, 2026, CrowdStrike OverWatch observed exploitation activity from a single ARTEX controller directed against entities in at least 14 countries over an 11-day window. The controller, which CrowdStrike Intelligence has linked to VAPOR PANDA infrastructure, intermittently exposed adversary tooling, target files, and ARTEX agent transcripts. This indicates multiple engagements (referred to as “tasks” by ARTEX) against multiple targets.

VAPOR PANDA used ARTEX to conduct extensive intrusions at the foreign ministries of two Latin America-based countries, likely compromised a third, and staged target files for use against foreign ministries in Central America and Asia. The adversary also compromised a Middle East-based interior ministry. One engagement focused on a single European country, targeting its foreign ministry, presidency, and prime minister's office, as well as defense, justice, finance, and intelligence entities. A separate engagement targeted 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. The adversary also compromised telecommunications providers in the U.S., Belgium, and the Philippines.

CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations, where the adversary gained access, deployed BLOODALCHEMY, and conducted follow-on credential spraying, network scanning, and reconnaissance. The adversary also conducted password-spraying and credential-scanning activity against at least 12 additional organizations, including U.S.-based think tanks and government entities in Europe.

Inside the Operation

VAPOR PANDA ran ARTEX primarily with the Chinese-origin DeepSeek LLM, supplemented with a second, subscription-based commercial LLM that CrowdStrike Intelligence could not confirm. In a single intrusion, VAPOR PANDA’s planning agents consumed on the order of 1.4 billion input tokens, indicating the scale of the automated activity and implying far higher consumption across the operation as a whole.

The campaign's reliance on open source components layered on top of commercial LLM subscriptions illustrates how adversaries can assemble scalable, multi-agent intrusions largely from publicly available resources.

ARTEX coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings, and goals, advancing each engagement from initial access through host reconnaissance and lateral movement. The framework kept a human in the loop: Recovered transcripts showed an operator issuing instructions in Chinese — marked with the label 【人类指令】 ("human instruction") and timestamped in China Standard Time — and directing the agents to write web shells, extract domain administrator passwords, and inventory endpoint sensor coverage.

Where CrowdStrike has previously observed threat actors use AI agents to assist individual intrusions, VAPOR PANDA used ARTEX to run multiple engagements simultaneously, intervening only to steer the agents at decision points. The recovered transcripts and staged tooling show an adversary pairing AI-driven workflow with well-established tradecraft:

- At a U.S.-based pharmaceutical organization, the agent chained an unsigned Security Assertion Markup Language (SAML) assertion and an XML external entity (XXE) flaw to query the cloud Instance Metadata Service, obtaining a role capable of issuing administration commands to thousands of instances before escalating to recover an enterprise administrator account.

- At a second U.S.-based pharmaceutical organization, the agent deployed web shells, abused an unauthenticated orchestration service to obtain root access in a production container environment, read Local Administrator Password Solution (LAPS) passwords, and abused resource-based constrained delegation to impersonate a privileged account.

- Against a Greek government entity, the operator supplied the agent with a 2022 directory export from the organization's mail server containing authentication keys that had likely not been rotated since the export. The agent used those keys to forge an administrator token and read mailboxes, then used VPN configurations recovered from a user's sent mail, alongside a VPN client key the operator described as originating from a May 2024 email leak, to reach the internal network.

Across these engagements, the agents pursued multiple attack paths in parallel, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure. They shifted to alternative approaches when a path failed. This breadth likely enables a single operator to apply a wider range of techniques against more targets at once than would be feasible through manual operations.

VAPOR PANDA was also observed directing the agents to evade endpoint defenses. At a global pharmaceutical organization, the operator instructed the agents to “在域里寻找没有装猎鹰的windows机器，从tasklist和文件夹目录判断” (English translation: "find Windows machines in the domain without Falcon, judging by tasklist and folder listings"), using 猎鹰, which is People’s Republic of China (PRC) red-team slang for the CrowdStrike Falcon sensor. Incorporating sensor coverage checks directly into the agentic workflow allows the adversary to concentrate follow-on activity on unprotected hosts.

BLOODALCHEMY

At a Middle East-based interior ministry and a Latin America-based foreign ministry, VAPOR PANDA deployed BLOODALCHEMY, a backdoor first publicly documented in October 2023. The adversary used a legitimate GameHook binary renamed svchost.exe to load a malicious DLL, graphics-hook-filter64.dll, which decrypted the BLOODALCHEMY payload file graphics-hook_config.bin. The adversary staged copies of all three files in the exposed open directories. The implant carries an internal project path, D:\ProjectX\Merman_New\, that likely reflects the malware's in-house development name.

Across the observed activity, BLOODALCHEMY communicated with VAPOR PANDA infrastructure.These indicators do not appear in prior public ARTEX reporting and are also consolidated in the IOC table at the end of this post.

Assessment

This campaign is separate from the ARTEX activity reported by industry under the Storm-0940 designation, likely indicating the AI-based framework is quickly gaining popularity among multiple China-nexus adversaries.

Since 2021, VAPOR PANDA has primarily targeted government, think tank, energy, and extractive organizations across Europe, North America, Oceania, and the UK to develop long-term access. This campaign marks the adversary's first observed use of AI-driven intrusion tooling and a notable broadening of its targeting into the pharmaceutical, semiconductor, nuclear, and defense sectors, as well as foreign ministries, across new regions. Agentic tooling like ARTEX enables this scale of expansion at speed, allowing a small team to pursue a wider target set than manual operations would support, rather than a wholesale shift away from the adversary's established access-development mission. The operation’s reliance on DeepSeek and additional commercial LLMs, run through a purpose-built harness, likely reflects a deliberate effort to construct a resilient toolchain from multiple model providers rather than depend on any single service.

China-nexus adversaries will highly likely continue adopting agentic frameworks such as ARTEX over the next 12 months, pairing them with commercially available LLMs, and enabling small teams to quickly scale intrusions across many targets simultaneously.

Recommendations

- Rotate signing keys, preauthentication keys, and service credentials after any suspected data exposure, including keys contained in historical backups and directory exports.

- Enforce SAML signature validation, require IMDSv2, and restrict cloud roles' command-execution permissions to the minimum required instances.

- Hunt for ARTEX markers, including command-line parameters containing artx or artex strings, artx-prefixed cloud roles, art18- administration-command comments, and the C:\ProgramData\artx5v\ directory.

- Patch internet-facing appliances, particularly long-lived Linux-based servers, and ensure they run the latest available software and firmware.

- Deploy an advanced, real-time endpoint detection and response (EDR) agent, such as the CrowdStrike Falcon sensor, across the environment, including on servers considered inaccessible from the public internet.

AI agents don't just answer questions anymore. They open files, use credentials, run code, install software, and run models locally, all at machine speed.

Every one of those actions happens on the operating system. This is where attacks land, and where CrowdStrike Falcon® Guardian excels: on the endpoint, at runtime.

Seeing the Complete Picture

Look at an agent session from the network and you only see part of the story. A gateway on its own sees the conversation: the prompt, the response, even the agent agreeing to do something it shouldn't. A web gateway sees the agent connect to a site it trusts. None of these sees what happens next, inside the machine.

Inside this gap, a hidden instruction can become a shell command, or a downloaded file can run with the user's access.

The CrowdStrike Falcon® sensor already sees processes, files, and network connections. With Falcon Guardian, the same sensor also sees the AI layer: prompts, models, tools, and skills. CrowdStrike® Agent Graph connects the AI layer to the execution layer in one causal chain, tracing supported agent sessions from prompt to impact. It runs on the Falcon sensor businesses already have. Teams can use CrowdStrike Agent Graph to see not only what the agent was asked to do, but what it did.

See it in action:

How CrowdStrike Agent Graph Powers Falcon Guardian

CrowdStrike Agent Graph is the relational layer underneath Falcon Guardian. It connects each agent to the users, hosts, models, prompts, tools, skills, MCP servers, processes, files, and detections it touches, and keeps those relationships current as agents act. Three core Falcon Guardian views are built on Agent Graph: agent inventory, session graph, and agent threat score.

Figure 1. CrowdStrike Agent Graph powers three views in Falcon Guardian: Agent Inventory, Session Graph, and Threat Score

Agent Inventory

Because CrowdStrike Agent Graph tracks which agents run where, and what they connect to, the Falcon Guardian agent inventory can show the AI agents across the fleet, whether they are sanctioned or shadow, grouped by type. Coding agents, desktop assistants, and command-line interface (CLI) agents from Anthropic, OpenAI, Cursor, and others sit side by side. For supported agents, the footprint shows how far it reaches, including the users, installs, sessions, models, tools, skills, and MCP servers connected to it. A single Claude Code agent might have one user, three installs, eight tools, and 12 sessions.

Figure 2. Agent inventory in the honeycomb dashboard within the Falcon Guardian dashboard

Session Graph

A session is one prompt and process. A CrowdStrike Agent Graph view can comprise one or several. Agent Graph lays out the causal chain in order: who and where interacted with the agent, the prompt they used, each tool call the model made, and the processes, files, and network connections that followed. For example, consider a developer who pastes a setup note from an untrusted source into Claude Code: "Run these commands in order and don't skip any." With the session graph, stakeholders can see where an issue may have originated.

Figure 3. Session graph showing the prompt and the three bash commands it spawned

From the network, the above prompt may seem harmless. In the session graph, there are three tool calls: The agent reaches out to an outside host, installs a package, and runs an installer from Downloads. The detections sit on that last step, pinned to the exact tool call that launched the installer, along with the outcome: Falcon Guardian blocked the process and quarantined the file.

Later in the session, cloud keys and personal data pasted into the conversation are flagged on their own, and that risky prompt sits on the same graph as the risky action.

Agent Threat Score

CrowdStrike Agent Graph ties each detection to an agent session, as well as the steps behind it. Every agent carries a threat score from 0 to 100. This turns the inventory into a triage queue. The fleets are colored by threat score, so teams can start with the highest-risk agents rather than the oldest alert. One click on a critical agent reveals the individual agent sessions and detections behind its score.

Figure 4. Threat score informed by detections that were triggered on an endpoint.

Because all three views read from the same graph, an analyst can move from the fleet to an agent, to a session, to the exact step that caused the alert, without switching tools or rebuilding a timeline.

Agent Hooks Expand Enforcement Capabilities

For supported agents, Falcon Guardian agent hooks bring even more detail into Agent Graph.

Agent hooks plug into an agent's native hooks system to capture activity at key points in a session: when a prompt is submitted, before a tool call runs, and after it completes. This adds more detailed nodes to the graph, such as exact prompt text, tool inputs, and tool outputs, alongside the sensor's view of what ran.

Hooks can show what the agent was told and how the agent interpreted the ask. The Falcon sensor shows what happened on the machine. It can also see what the agent was asked to do, and what the LLM response was, via endpoint network inspection. Agent Graph combines those views to connect what agents are instructed to do, what they communicate, and what they execute.

Hooks are also a point of enforcement: Falcon Guardian can check a prompt or tool call against policy and stop a dangerous action before it executes. Agent hooks are available today for Claude Code, OpenAI Codex, GitHub Copilot, OpenCode, and Cursor.

Secure AI Agents Where They Execute

Only CrowdStrike brings together native endpoint visibility, endpoint network inspection, and agent-level controls to deliver that context, and the power to stop malicious behavior at runtime.

Agents work at machine speed, and so do their mistakes. CrowdStrike Agent Graph shows what they were asked and what they actually did, so security teams can stop them at runtime when they become a threat.

Agent Graph is the foundation underneath Falcon Guardian. It powers the agent inventory, which shows the AI agents running across your fleet and how far they reach; the session graph, which traces each session from prompt to impact; and the agent threat score, which tells teams where to look first. Agent hooks add more detail and a point of enforcement for supported agents, and it all runs on the Falcon sensor you already have. That's how Falcon Guardian secures AI agents where they execute: on the endpoint, at runtime.

Every organization has a different threat profile. Industry, geography, infrastructure, business operations, and the broader technology ecosystem all influence which adversaries and threats matter most.

The challenge is putting threat intelligence to work at scale to identify the greatest threats to each business. The intelligence that security teams rely on is as varied as the threats they face. Organizations draw from commercial threat intelligence providers, industry information sharing and analysis centers (ISACs), government sources, open-source research, trusted partners, and indicators uncovered through their own threat hunting and incident response efforts.

Modern security operations need a "Bring your own intelligence" strategy to manage these disparate sources. CrowdStrike Falcon® Next-Gen SIEM brings threat intelligence and security telemetry together in Third-Party IOC Management, a new feature that enables organizations to incorporate their own intelligence directly into detection and investigation workflows.

By centralizing the ingestion, curation, and lifecycle management of third-party indicators, security teams can operationalize the intelligence most relevant to their environment alongside CrowdStrike's adversary intelligence and telemetry from both the CrowdStrike Falcon® platform and third-party sources.

Turn Threat Intelligence into a Detection Advantage

Valuable indicators are often scattered across spreadsheets, ticketing tools, and threat intelligence platforms, which are often disconnected from the security telemetry that analysts rely on. Manually importing and maintaining indicators across multiple tools creates operational overhead. Limited real-time correlation and outdated indicators of compromise (IOCs) can delay threat detection, generate unnecessary alerts, and slow investigations.

Instead of manually moving indicators between disconnected tools, security teams can manage their intelligence within Falcon Next-Gen SIEM, reducing operational complexity and accelerating the path from threat intelligence to actionable security insights.

Figure 1. See how Third-Party IOC Management in Falcon Next-Gen SIEM helps security teams ingest, manage, and correlate their own threat intelligence with security telemetry to accelerate detection and investigation.

Third-Party IOC Management helps eliminate the operational barriers that slow detection and investigation through four key capabilities:

- Eliminates manual IOC onboarding: Ingest and manage third-party IOCs, including IP addresses, domains, URLs, and file hashes, from commercial intelligence providers, industry sharing communities, and internal investigations. With support for STIX/TAXII, APIs, and direct uploads, security teams can streamline intelligence onboarding, automatically consolidate duplicate indicators across sources, and reduce the effort required to maintain intelligence across disparate tools.

- Accelerates detection and threat hunting: Put third-party intelligence to work in Falcon Next-Gen SIEM through curated indicator lists that are automatically updated. Security teams can use these indicators in correlation rules and threat hunting searches to identify known malicious infrastructure and suspicious activity across security telemetry, accelerating detection and investigation without manually maintaining separate indicator lists.

- Reduces alert noise with automated IOC lifecycle management: Maintain control over third-party indicators with expiration settings and management capabilities that help prevent outdated intelligence from creating unnecessary noise. By keeping IOC collections current and relevant, security teams can reduce manual maintenance, minimize false positives associated with stale indicators, and focus investigations on threats that matter.

- Expands detection coverage with organization-specific intelligence: Extend CrowdStrike's adversary intelligence and AI-native detection capabilities with intelligence specific to your organization. By bringing third-party and proprietary indicators together with CrowdStrike intelligence and security telemetry, teams can broaden detection coverage and investigate threats with context that reflects both the global threat landscape and their unique environment.

To see how these capabilities can work together in practice, consider a common industry-specific threat intelligence scenario. A financial services organization receives indicators associated with a targeted phishing campaign from an industry information-sharing community. With Third-Party IOC Management, the security team can bring these indicators into Falcon, consolidate duplicates, and manage their lifecycle while using them in Falcon Next-Gen SIEM to search security telemetry and build correlation rules to identify potentially related activity. This turns industry-specific intelligence into actionable detection and investigation context without manually distributing indicators across disconnected tools.

Connect Intelligence to Accelerate Security Operations

With Third-Party IOC Management built into Falcon Next-Gen SIEM, organizations can maximize existing threat intelligence investments while reducing the complexity of maintaining disconnected tools and integrations. Rather than replacing the intelligence sources they rely on, security teams can bring that intelligence into the platform where they detect and investigate threats.

This consolidation also reduces the operational burden on analysts and detection engineers. Fewer manual handoffs, less context switching, and centralized IOC management mean teams can spend less time maintaining intelligence workflows and more time identifying suspicious activity, investigating threats, and taking action.

As security operations evolve toward the agentic SOC, the quality of AI-driven investigations and decisions will increasingly depend on access to relevant, timely, and contextualized security data. AI agents need more than telemetry alone; they need intelligence that helps explain what suspicious activity means within an organization's unique threat landscape.

By bringing third-party IOCs together with CrowdStrike’s adversary intelligence and security telemetry in Falcon Next-Gen SIEM, organizations can reduce data fragmentation and build a richer foundation for AI-driven security operations. This convergence creates opportunities for AI agents to correlate indicators with security events, enrich investigations with threat context, and support faster, more informed response decisions.

Additional Resources

- See how Falcon Next-Gen SIEM brings your threat intelligence and security telemetry together. Try it free for 15 days.

- Bringing your own intelligence is one piece of a modern SOC. Download The Complete Guide to Next-Gen SIEM to see how security data, automation, and AI agents work together.

As adversaries broaden their operations across cloud environments, identities, SaaS applications, and AI systems, security teams need threat hunting that can keep up. Suspicious activity in one environment may be part of a larger intrusion spanning multiple domains, making it increasingly important to connect signals across the attack surface.

To expand detection coverage across the widening attack surface, CrowdStrike Falcon® Adversary OverWatch™ threat hunting has added two key capabilities: 24/7 managed hunting for AI applications and autonomous agent activity through CrowdStrike Falcon® Guardian, and deeper, telemetry-driven hunting for Google Cloud.

This expansion builds on our recent launch of Falcon Adversary OverWatch Cross-Domain, which extends 24/7 managed threat hunting across identity, cloud, AI agent activity, SaaS applications, and third-party data. This equips CrowdStrike OverWatch threat hunters with broader visibility to uncover adversary activity across the CrowdStrike Falcon® platform, and eliminates the need for customers to acquire separate threat hunting SKUs for each eligible module or domain.

How AI Can Become Part of a Cross-Domain Intrusion

To understand the potential impact of AI on cross-domain activity, consider an intrusion that begins with a compromised identity provider session following a phishing attack. The adversary could register a rogue Quick Emulator (QEMU) device with the organization’s multifactor authentication (MFA) solution, gain persistent access, and pivot into connected SaaS applications.

After gaining access to Claude through the compromised identity, the adversary could use the LLM to enumerate connected applications and local files, generate scripts to collect credentials, and scan skill repositories and agentic infrastructure. The intrusion could culminate in a command-and-control (C2) backdoor connecting a compromised endpoint to adversary infrastructure.

Viewed independently, the identity compromise, suspicious AI interactions, and endpoint execution may appear unrelated. Together, they reveal how an intrusion could span multiple environments, underscoring why CrowdStrike OverWatch hunters need cross-domain visibility to uncover the full scope of adversary activity.

Figure 1. The anatomy of an AI-enabled, cross-domain intrusion

Extending Threat Hunting and MDR to AI

As organizations increasingly connect AI systems to sensitive data, applications, and infrastructure, adversaries have new opportunities to exploit trusted access and legitimate AI capabilities. According to the CrowdStrike 2026 Threat Hunting Report, AI agents triggered 2.5 times more detection leads than human activity, underscoring how AI-driven activity is increasing the volume and velocity of signals threat hunters must assess.

Falcon Adversary OverWatch Cross-Domain now extends 24/7 proactive threat hunting to AI applications and autonomous agent activity monitored by CrowdStrike Falcon Guardian. By combining Falcon Guardian's runtime context with telemetry across the Falcon platform and frontline adversary intelligence, CrowdStrike OverWatch hunters can uncover manipulation, abuse, and emerging adversary tradecraft that automated detections may miss. This broader context helps hunters connect suspicious AI activity to larger intrusions spanning identities, applications, and infrastructure.

In addition to proactive threat hunting for AI applications and agents, CrowdStrike Falcon® Complete for Falcon Guardian extends 24/7 expert-led managed detection and response (MDR) to AI coding assistants and agents monitored by Falcon Guardian. Specialized analysts investigate malicious prompts, suspicious agent behavior, and threats involving AI tools and skills. Using CrowdStrike Agent Graph, analysts connect AI agent activity with downstream endpoint execution to assess the scope of threats and rapidly contain and remediate confirmed attacks.

Together, Falcon Adversary OverWatch and Falcon Complete bring proactive threat hunting and expert-led response to the AI attack surface.

Going Deeper in Google Cloud

Cloud environments remain a critical part of the modern attack surface. eCrime cloud-conscious activity surged 171% year-over-year as adversaries increasingly used stolen credentials, misconfigurations, and legitimate tools to operate across cloud infrastructure, the CrowdStrike 2026 Threat Hunting Report found.

These attacks can be difficult to uncover because adversaries often blend malicious activity with legitimate administrative operations. Threat hunters need access to detailed cloud telemetry, an understanding of adversary techniques, and the context to connect suspicious events.

CrowdStrike is extending Falcon Adversary OverWatch's advanced threat hunting capabilities to Google Cloud, delivering the same depth and precision of telemetry-driven hunting available in Amazon Web Services (AWS) and Microsoft Azure. By hunting directly on underlying cloud telemetry rather than relying solely on product-generated detections, CrowdStrike OverWatch hunters can identify suspicious activity earlier in the attack chain, including service account misuse, privilege escalation, and signs of lateral movement.

With this expansion, Falcon Adversary OverWatch now delivers consistent, telemetry-driven managed threat hunting across AWS, Azure, and Google Cloud. This helps security teams uncover sophisticated threats across multi-cloud environments without managing separate hunting operations for each cloud.

Broader Hunting Coverage in a Single Offering

Falcon Adversary OverWatch analyzes 7 trillion events daily, surfaces more than 14 million detection leads, and delivers over 36,000 high-fidelity customer notifications each year. Backed by CrowdStrike intelligence on more than 290 tracked adversaries across nation-state, eCrime, and hacktivist groups, CrowdStrike OverWatch hunters know how adversaries operate, the techniques they use, and where to find them.

With proactive AI threat hunting and deeper Google Cloud coverage, CrowdStrike is extending Falcon Adversary OverWatch's visibility across the modern attack surface and connecting suspicious activity across domains to uncover and stop adversaries before they achieve their objectives.