CrowdStrike dropped their 2026 Threat Hunting Report yesterday. The headline quote — "AI is now embedded across modern adversary operations" — is accurate but undersells what's actually in the data. Everyone's been saying AI makes attackers faster. That part isn't news anymore.
What is news: attackers have flipped the target. For the first time, AI infrastructure itself — the frameworks, APIs, and packages your team uses to build and run AI tools — is a primary objective. Not just a weapon. A target.
The Attack That Should Get More Coverage
Here's one from the report that barely made the mainstream security coverage.
In June 2026, a North Korean threat group (STARDUST CHOLLIMA, tied to the Lazarus Group) approached a developer at Mastra AI on LinkedIn. Not a phishing email. Not a fake invoice. A LinkedIn message, a video call, and a social engineering play that ended with the developer clicking a malicious link.
That one click gave them enough access to inject a malicious package as a dependency into 131 Mastra AI framework packages. Every developer pulling those packages into their project — small dev shops, NGOs, public sector teams building internal tools — suddenly had North Korean malware as part of their codebase.
Mastra isn't a niche tool. It's one of the faster-growing open-source AI agent frameworks right now, exactly the kind of thing a three-person team uses to build their first internal AI workflow.
The 48-Hour Problem
Separate from the Mastra story, the report found that 88% of exploits using a known proof-of-concept happened within 48 hours of that proof-of-concept going public. China-nexus actors were moving inside 24 hours.
Here's what that means in practice: a CVE gets published for an AI tool you're using. Security researchers release a working demo exploit (standard practice — it forces vendors to patch). Within one business day, nation-state groups are using that exploit in live attacks.
Your team probably doesn't have a 24-hour patch cycle. Most small orgs don't check security advisories daily. You're likely updating software when something breaks or when you remember to, not on a 48-hour security response cadence.
That gap — between when a CVE drops and when you actually patch — is now being weaponized systematically.
AI Systems Under Direct Fire
Beyond supply chain attacks, the report documented something weirder: a campaign that sent nearly 200,000 AI model requests in two minutes. Someone was hammering an AI endpoint — possibly to extract data, burn a competitor's API budget, or test model behavior at scale.
If you're running anything that exposes an AI model to the outside world — a customer-facing chatbot, an internal API endpoint, a document Q&A tool — you now need to think about what happens when someone tries to weaponize it. That wasn't a realistic threat category two years ago.
What This Actually Means for a 10-50 Person Org
None of this requires a security team to respond to. Here's what actually moves the needle:
Stop using latest in your AI package dependencies. If you're building with Mastra, LangGraph, LangChain, Flowise, n8n, or any npm-based AI tooling, pin your versions explicitly. mastra@^0.9.0 means you automatically pull whatever the latest patch is — including any that got backdoored. mastra@0.9.2 means you're only running what you've reviewed. This change takes ten minutes.
Set up dependency alerts. GitHub's Dependabot and Snyk both have free tiers that will notify you when a package you depend on gets a CVE. Most small orgs don't have this configured. Takes an hour to set up, runs itself afterward.
Watch what your technical staff is clicking, not just your finance team. The Mastra attack worked by targeting a developer, not a CFO. Social engineering is moving toward the people who actually have access to your infrastructure. One click from the right person is all it takes to compromise 131 packages.
Rate-limit your AI endpoints. If you've built or deployed anything AI-facing, add rate limiting and basic anomaly detection. Most cloud platforms and AI API gateways (Portkey, LiteLLM, Cloudflare AI Gateway) have this built in. It's not perfect, but it makes your endpoint a less attractive target than the one next door that has none.
The Small Org Advantage
Large enterprises are slow. Their security teams are processing thousands of alerts. Their patch approval cycles take weeks and three sign-offs. You can act on this in days, not quarters.
The organizations that are going to get hit hardest by this shift are the ones running AI tools with zero visibility into their dependencies and no one monitoring their AI endpoints. Right now, that's most organizations. But it doesn't have to stay that way.
If you want help auditing your current AI tool stack for supply chain exposure and setting up basic monitoring, this is exactly what we do in a sprint. Two weeks, working with your actual team, getting the real gaps closed — not a report about what you should consider doing someday.
The window between "this is news" and "this is routine threat" is shrinking. Same as the exploit window.