AI Agents Are Breaking Into Networks in Seconds. Security Teams Have No Agreed Metric to Track It.

Quick Facts

• CrowdStrike recorded a fastest-ever network breakout of 27 seconds in 2026, down from an average of 1 hour 58 minutes in 2018.
• AI agents issue roughly 1,500 commands per hour versus dozens for a human attacker at a keyboard.
• GitGuardian found 28.76 million new secrets exposed in public GitHub commits in 2025, a 34% year-over-year increase.

The security industry's standard for measuring how fast attackers move through a network is breaking down, and no one has agreed on what comes next. The speed of AI-powered attacks is why CrowdStrike is moving away from "breakout time" — the interval between an attacker's first foothold and lateral movement to another host — a metric it introduced in 2018 and the industry has cited ever since.

"It's just speed and volume," Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, told VentureBeat. Even CrowdStrike's own executives have not settled on what should replace the metric.

The Numbers Behind the Collapse

When CrowdStrike published its first Global Threat Report in 2018, the average breakout time was 1 hour and 58 minutes. The 2026 report put the eCrime average at 29 minutes — a 65% speed increase from 2024's 48-minute average — with the fastest single observed breakout clocking in at 27 seconds. In one intrusion, data exfiltration began within four minutes of initial access.

AI-enabled adversaries increased operations 89% year-over-year, applying AI across reconnaissance, credential theft, and evasion. CrowdStrike says it has seen three times as many agentic intrusions in the second half of 2026 as in the first half.

Credentials Are the Primary Target

GitGuardian's research on AI agent identity found 28.76 million new secrets exposed in public GitHub commits in 2025, the largest single-year jump the company has recorded. AI-service credentials specifically surged 81% year-over-year to 1.27 million leaked secrets. GitGuardian also found 24,008 unique secrets in public Model Context Protocol configuration files.

The persistence problem compounds the exposure. GitGuardian tracked credentials originally identified in 2022 and found 64% remained valid and exploitable as of early 2026. Code commits assisted by Claude Code leaked secrets at roughly 3.2%, about double the 1.5% baseline rate for unassisted commits.

Attacks in the Wild

An Argentine healthcare organization illustrates how agentic attacks now operate. Twenty-nine seconds after access controls blocked its first attempt, an AI agent pivoted and targeted the domain controller through SQL. Seventeen minutes later, it had pulled five credential hashes. CrowdStrike identified a "Supervisor" Claude Code agent that selected the next task and an "Executor" agent that carried it out. The campaign compromised at least 15 healthcare organizations in Argentina.

A larger campaign targeted PaperCut print-management servers. A likely Russian-speaking threat actor used hundreds of AI agents to build, test, and refine exploits for two PaperCut vulnerabilities. GreyNoise data shows the operation compromised at least 440 PaperCut instances tied to 395 organizations across 48 countries. The attacker went from an empty workspace to remote code execution against a real victim in under four hours. One U.S. high school went from initial access to full domain-admin privileges in seven minutes. GreyNoise recorded 11 organizations compromised in 26 seconds once the automated campaign reached full speed.

The Patch Window Is Closing the Wrong Way

Defenders are losing ground on remediation timing as well. Verizon's 2026 Data Breach Investigations Report put the median time to fully remediate a known exploited vulnerability at 43 days, up from 32. Moody's, citing Flashpoint research, found the average time from public disclosure to first exploitation fell from 115 days in 2024 to 44 days in 2025. The Cloud Security Alliance has documented AI systems generating working CVE exploits in 10 to 15 minutes at roughly one dollar per attempt. For complex enterprise applications, the Qualys April 2026 patch benchmark found mean time to remediation reached five months and 10 days.

What Security Teams Face Now

The gap between attacker speed and defender capacity is no longer theoretical. AI agents do not need to sleep, do not need to approve each step, and can run thousands of commands while a human analyst reads one alert. The Argentine and PaperCut cases both show a single operator setting the rules while agents handle reconnaissance, exploitation, and post-exploitation autonomously.

For software and technology companies, the credential exposure data carries direct operational weight. AI-assisted development is accelerating secret leakage, and most of those secrets stay valid for years. Teams that have not audited non-human identities and rotated credentials exposed through AI coding tools are carrying risk that attackers are already exploiting at machine speed.