AI Crosses From Assistant to Operator in Live Attacks, Check Point

Executive Summary

AI has crossed a critical threshold in cyber operations: it no longer merely assists attackers but now runs live intrusions autonomously, according to the AI Security Report 2026 published today by Check Point Research. The report documents AI building deployment-ready malware, executing multi-channel social engineering at scale, and enabling attacks against Mexican government agencies and China-nexus espionage campaigns. The shift from force multiplier to autonomous operator represents a structural change in the threat landscape that defenders must address at the architectural level.

Technical Analysis

The report, based on telemetry from Check Point's global threat intelligence network, identifies several concrete trends. AI now builds complete offensive frameworks: one developer used an AI environment to produce VoidLink, an 88,000-line command-and-control (C2) framework, in under a week. The AI's involvement is often invisible in the finished artifact, making attribution and detection harder.

Attackers overwhelmingly prefer commercial AI models over self-hosted alternatives, exploiting their agentic architecture rather than single-prompt jailbreaks. The durable bypass technique has evolved into a planted configuration file that an agent loads and trusts across sessions, enabling persistent abuse. Phishing-as-a-service kits now embed a language model with the jailbreak pre-installed, and conversational AI voice-agent services automate vishing and one-time-passcode theft at scale.

Indirect prompt injection is rising sharply: detections of longer malicious payloads increased roughly fivefold between March and May 2026, approaching 1% of observed prompts in May. Longer payloads are characteristic of content-borne and agentic attack paths, indicating that indirect prompt injection is becoming operationally relevant.

Enterprise data leakage through GenAI is a persistent and growing risk. High-risk prompts doubled from 2% to 4% over the past year, while organizations used an average of 10 AI applications each month, many without official approval. Sector-level analysis reveals uneven distribution: Business Services recorded the highest rate of high-risk GenAI prompts at 5.91%, meaning nearly one in every 17 AI interactions carried a significant risk of sensitive data exposure.

Mitigations & Recommendations

Check Point Research advises organizations to treat AI as an active attack surface rather than a passive tool. Defenders should implement strict data governance for GenAI interactions, monitoring and classifying prompts for sensitive data exposure. Agentic architectures require isolation and least-privilege controls to prevent planted configuration files from enabling persistent abuse. Organizations should also audit AI supply chains and model behavior for indirect prompt injection vulnerabilities, given the sharp increase in long-payload attacks observed between March and May 2026.