Recent findings from CrowdStrike highlight a concerning trend in the cybersecurity landscape: adversaries are increasingly leveraging artificial intelligence (AI) to enhance their exploitation of public vulnerability research. This shift not only accelerates the speed at which vulnerabilities are weaponized but also complicates the defensive landscape for organizations worldwide. The implications of this trend are profound, as adversaries are now able to operationalize vulnerabilities at an unprecedented pace.
Exploitation of Fortinet Vulnerabilities
In a notable case, CrowdStrike’s Counter Adversary Operations identified a modified proof-of-concept (POC) exploit for a Fortinet vulnerability (CVE-2024-55591) associated with the Iran-linked adversary STATIC KITTEN. This modified exploit, discovered in February 2026, contained 13 hardcoded payloads designed to perform various malicious actions, including creating backdoor accounts and establishing persistence within compromised systems. The original POC, released in January 2025, executed a single user-provided command, but the modified version reflects a systematic approach to turning a demonstration tool into a comprehensive exploit.
AI’s Role in Vulnerability Research
The integration of AI into vulnerability research is reshaping the landscape of cybersecurity. CrowdStrike notes a significant increase in the number of vulnerabilities reported in recent Microsoft Patch Tuesdays, coinciding with advancements in AI models. However, detecting the direct use of AI by adversaries remains challenging due to visibility gaps and the lack of distinct identifiers for AI-generated exploit code. Patterns indicative of AI assistance, such as well-commented code and structured organization, can also emerge from highly skilled human developers.
Threat actors are employing AI to augment their vulnerability research through several vectors, including:
- Direct interaction with frontier AI models, attempting to bypass safeguards and export controls.
- Modification of open-weight proprietary models for malicious purposes, which are less monitored for abuse.
- Utilization of AI-assisted public vulnerability research published by industry sources.
For instance, the discovery of the CopyFail vulnerability was reportedly facilitated by AI, showcasing how adversaries can leverage AI tools to enhance their capabilities.
Implications for Cyber Defenders
The implications of adversaries utilizing public vulnerability research are significant. As more POC exploits become available shortly after disclosure, organizations face increasing challenges in prioritizing patches. CrowdStrike’s data indicates that 91% of vulnerabilities with POCs were weaponized within 48 hours, with some exploited as quickly as 35 minutes after becoming public. This rapid operationalization of vulnerabilities underscores the inadequacy of traditional patch cycles, which often span weeks or days.
Moreover, the democratization of exploitation means that a broader range of adversaries, regardless of skill level, can participate in attacks. This shift increases the volume of potential attackers and complicates the threat landscape. As motivation and intent become the primary barriers to exploitation, organizations must adapt their strategies to address this evolving threat.
Conclusion
The vulnerability research ecosystem, while a critical asset for the security community, presents significant challenges as adversaries increasingly exploit public research. Organizations must recognize that public vulnerability disclosures serve as a starting point for adversaries and adjust their intelligence, patching timelines, and detection capabilities accordingly. By doing so, they can better navigate the complexities of a rapidly evolving threat landscape.
For further insights into the evolving dynamics of vulnerability exploitation, refer to CrowdStrike’s detailed analysis on the subject here.
