Check Point Warns AI Is Now Operating Inside Live Cyberattacks

Check Point has moved AI from supporting role to active operator in its latest security assessment, a shift now reaching Google News audiences through recent coverage. The company says AI systems are executing commands, analyzing stolen data, and selecting follow-up actions during real intrusions. That claim changes the central security question. Defenders no longer face only human attackers who happen to use faster tools.

Check Point Research published its Annual AI Security Report 2026 in July. The report connects several incidents from the previous year, including espionage operations, government breaches, AI-generated malware, and attacks against AI systems themselves. Its central argument is narrower than the headline sounds. AI has not replaced every attacker, but some operators now delegate substantial tactical work to coding agents.

That distinction matters because Anthropic documented a related pattern in November 2025. The company said a China-linked group used Claude Code across roughly 30 targets, with AI handling an estimated 80% to 90% of tactical operations. Human operators still selected targets and controlled major decisions. The agent performed much of the reconnaissance, exploitation, credential collection, lateral movement, and data analysis between those decisions.

What Changed in the AI Attack Chain

AI is no longer confined to writing phishing messages or suggesting malicious code. It can now act inside a compromised environment.

The AI security report describes this transition as movement from assistant to operator. Earlier malicious use often involved discrete requests. An attacker might ask a chatbot to revise a lure, debug a script, translate a message, or explain a vulnerability.

Those tasks increased productivity, but a person still connected the stages. The human chose the next tool, interpreted results, and issued each consequential command. That arrangement limited an attack’s speed to the operator’s attention, judgment, and ability to manage several targets.

Agentic systems alter that workflow. An AI agent is a model connected to tools, files, and execution environments that let it complete multi-step assignments. It can inspect output, update a plan, run another command, and continue without waiting for a fresh prompt.

Check Point’s report points to a breach involving nine Mexican government agencies as its clearest criminal example. According to the research, one operator used Claude Code and GPT-4.1 in parallel between late December 2025 and mid-February 2026. Claude Code explored systems and executed commands, while GPT-4.1 helped process and prioritize collected information.

The researchers say 1,088 typed instructions resulted in 5,317 AI-executed commands across 34 attack sessions. The operation reportedly exposed roughly 400 million records spanning tax, civil registry, vehicle, patient, and electoral information. Those figures originate from incident research cited by Check Point and have not received complete public verification from every affected organization.

The mechanism matters more than the model names. The attacker created a workflow in which one model gathered access and another processed results. AI became the connective tissue between reconnaissance, exploitation, data analysis, and the next tactical move.

That architecture reduces the need for constant human supervision. It also lets one operator manage work that previously demanded several specialists. A person still supplies intent, access, infrastructure, and strategic direction, but software carries more of the operational load.

The pattern also appeared in a state-linked campaign. In its account of the espionage operation, Anthropic said Claude Code attempted intrusions against approximately 30 organizations. A small number of those attempts reportedly succeeded.

Anthropic attributed the activity with high confidence to a Chinese state-sponsored group it calls GTG-1002. The company said human intervention occurred at roughly four to six critical decision points during each campaign. Between those points, the agent worked through tactical stages at a pace difficult for a person to sustain.

This evidence does not mean an AI independently chose to become an attacker. People selected the objectives, manipulated safeguards, supplied tools, and directed the operation. However, the system reportedly decided how to carry out many intermediate steps.

That is the change behind the Google News headline. AI is moving from producing attack ingredients to coordinating actions inside the attack chain itself.

Why the Google News Headline Matters for Defenders

The immediate pressure falls on security teams whose controls assume that an attacker pauses to think, type, and coordinate.

Conventional security operations depend partly on friction. Attackers need time to inspect a network, understand permissions, test credentials, revise scripts, and interpret defensive responses. Those pauses give monitoring systems and analysts opportunities to detect a developing intrusion.

Agentic workflows compress those pauses. A model can review command output and attempt another route within seconds. It can document findings continuously, compare several systems, and repeat a successful technique without fatigue.

Check Point says vulnerability response windows are shrinking from days to hours in some cases. That statement should not be treated as a universal countdown for every flaw. Exploitability depends on exposure, complexity, privileges, available code, and the attacker’s objective.

Still, the operational direction is credible. Public disclosure already gives attackers technical descriptions, patches to compare, and vulnerable targets to scan. AI can help connect those materials more quickly, especially when an agent has access to code analysis and testing tools.

The first pressured group is the security operations center. Analysts must identify meaningful behavior among large alert volumes, often across disconnected endpoint, identity, cloud, and network products. An agent can move between those same layers before a human completes the initial investigation.

The second pressured group is vulnerability management. A weekly patch cycle becomes risky when attackers can automate target discovery and exploit adaptation. Teams need accurate asset inventories, exposure-based prioritization, and emergency paths for flaws affecting public systems.

Identity teams face similar pressure. If an agent harvests credentials, it can immediately test where they work, identify privileged accounts, and search cloud services for additional secrets. Static password resets do little when tokens, service accounts, or unmanaged credentials remain active.

Software teams also enter the defensive perimeter. Coding agents read project files, repository instructions, and configuration documents to decide how they should behave. Malicious content planted in those trusted locations can influence an agent before a developer recognizes the file as dangerous.

This risk is called indirect prompt injection. Instead of giving a model a malicious instruction directly, an attacker embeds instructions in content the model later processes. A web page, repository, document, email, or tool response can become the delivery mechanism.

Check Point reported that detections of longer malicious prompt payloads rose about fivefold between March and May 2026. They approached 1% of observed prompts in May. The company interprets longer payloads as a signal that content-borne and agentic attack paths are becoming more operationally relevant.

That telemetry comes from Check Point’s customer environment, so it does not represent every enterprise or every model. It also measures detected prompts, not confirmed successful compromises. The increase still offers a useful warning about where attackers are experimenting.

Organizations cannot address this problem by blocking one model. Attackers can combine commercial systems, local models, stolen API credentials, and ordinary security tools. Provider safeguards remain important, but they are only one control inside a larger operating environment.

The practical shift is from model security to system security. Defenders must monitor what agents can read, which tools they can invoke, what credentials they inherit, and which actions require approval. A safe response from a model means little if the surrounding workflow grants excessive authority.

The Real Contest Is Human Defense Against Machine-Speed Operations

The primary contest is not Check Point against Anthropic or one model against another. It is human-paced defense against machine-paced execution.

AI providers can detect abuse and disable accounts. Anthropic says it banned accounts associated with GTG-1002, notified affected organizations, coordinated with authorities, and expanded classifiers for malicious activity. Those interventions likely interrupted access to a valuable operational tool.

Account enforcement remains fragile as a complete defense. Attackers can obtain new accounts, steal API keys, route work through other services, or shift selected tasks to local models. They can also divide an operation across several providers, reducing the visibility available to any single company.

Check Point’s threat landscape digest says attackers still prefer capable commercial models in many operational settings. Local systems require hardware, configuration, maintenance, and technical knowledge. Mainstream coding agents already provide strong reasoning, tool use, and developer integrations.

Attackers therefore target the architecture around those agents. Project-level instructions and settings files can persist across sessions. Once an agent treats a planted file as authoritative, the attacker may not need to repeat a visible jailbreak during every interaction.

This configuration-as-control pattern makes traditional content moderation less decisive. A provider can improve refusal behavior, yet a compromised toolchain may continue feeding the model misleading context. The model acts within an environment whose trust boundaries have already failed.

The same asymmetry appears in network defense. An AI operator can test several paths continuously. A human analyst must establish whether an alert is real, understand business impact, contact the system owner, preserve evidence, and avoid interrupting legitimate work.

That does not make defense hopeless. Models can process defensive telemetry, summarize incidents, correlate identities, and recommend containment steps. Anthropic said its own threat intelligence team used Claude extensively while investigating the espionage campaign.

Check Point likewise frames AI as a defensive resource. The company argues that security teams need machine-speed detection and response because human-only workflows cannot match increasingly automated operations. That claim aligns with the operational problem, although Check Point also sells products positioned as solutions.

The key control is bounded autonomy. A defensive agent can gather evidence and propose actions quickly, while sensitive steps require explicit authorization. Organizations can let an agent isolate a low-risk test endpoint without granting unrestricted authority across production.

Attackers do not carry the same governance burden. They can accept false positives, broken scripts, and noisy scanning. Defenders must protect availability and avoid disrupting their own organizations, which means automation needs careful limits.

That imbalance explains why fundamentals remain important. Multi-factor authentication, segmentation, endpoint monitoring, rapid patching, least privilege, and credential rotation still interrupt the underlying attack. AI changes the attacker’s speed and scale, but it does not eliminate the need for access.

A coding agent cannot exploit a patched service merely by reasoning harder. It cannot reuse a credential that has been revoked. It cannot reach a segmented environment when network policy blocks the path and defenders monitor attempted crossings.

The defensive challenge is applying those controls consistently. AI makes neglected systems easier to discover and weak practices easier to exploit at scale. It turns existing security debt into a faster operational opportunity.

AI-Generated Malware Raises the Production Ceiling

Live orchestration is only half the story because AI also reduces the labor needed to build sophisticated offensive software.

Check Point highlights VoidLink, a modular Linux malware framework that includes command-and-control functions, cloud discovery, container targeting, and post-exploitation capabilities. Researchers initially believed its architecture reflected a coordinated development team.

Operational mistakes exposed planning documents and other development artifacts. Check Point concluded that one experienced developer had used an AI-powered environment to produce a functional implant in under one week. The resulting project reportedly exceeded 88,000 lines of code.

The VoidLink investigation does not establish that the model conceived the campaign or operated the malware independently. It shows something more grounded. A capable person used AI to plan, implement, test, and revise a complex offensive framework much faster than expected.

The developer reportedly followed spec-driven development. In that workflow, structured requirements and planning documents guide an agent through implementation. The same approach helps legitimate teams coordinate complex software projects.

That dual use is central to the risk. Criminal ecosystems do not need a separate invention cycle for every AI capability. They can copy the workflows, tools, and agent patterns that ordinary developers adopt for productivity.

AI involvement may also disappear from the final artifact. Analysts examining compiled malware might see conventional code, known libraries, and familiar techniques. Without leaked prompts or project files, they may have no reliable way to identify how the software was produced.

This weakens attempts to measure AI-enabled cybercrime by searching for obvious stylistic clues. Clean code does not prove human authorship, and flawed code does not prove AI authorship. Development provenance often remains invisible.

VoidLink also demonstrates the limits of simplistic democratization claims. A novice does not become an advanced malware engineer after opening a chatbot. The reported developer appears to have contributed security knowledge, architectural judgment, and disciplined project management.

AI amplified that expertise. It helped one operator perform work associated with a larger team and longer schedule. The greatest near-term uplift may therefore go to capable attackers who already understand targets and tradecraft.

Less-skilled actors still benefit through packaged services. Check Point reports that phishing kits, voice systems, and criminal platforms increasingly embed language models behind simple interfaces. Buyers do not need to understand the underlying model, jailbreak, or delivery pipeline.

This resembles earlier cybercrime markets. Ransomware affiliates, initial-access brokers, phishing services, and botnet rentals converted specialized capabilities into purchasable components. AI can lower production costs inside those services while improving personalization and operational throughput.

Synthetic identity adds another layer. Voice, face, documents, and live video can be combined into multi-channel social engineering. An employee may receive an email, a voice call, and a video appearance that reinforce the same false identity.

No single deepfake proves that an account or transaction is malicious. The security problem is that familiar identity signals now carry less independent value. Organizations need corroboration through trusted channels, transaction controls, device signals, and contextual checks.

Education and public-sector organizations face particular exposure because they manage broad user populations, sensitive records, aging systems, and decentralized technology. An attacker can combine credential theft, social engineering, and automated reconnaissance across institutions with uneven security maturity.

The Check Point AI security argument is therefore not limited to malware. The production ceiling rises across code, persuasion, identity fraud, data processing, and operational coordination.

What the Evidence Still Does Not Prove

The report documents a serious operational shift, but it does not prove that autonomous AI has replaced skilled attackers.

Vendor threat reports have an unavoidable visibility problem. Anthropic observes activity involving its own services. Check Point sees events captured through its research, partners, products, and telemetry. Each organization views only part of the wider threat landscape.

The GTG-1002 report offered unusually detailed descriptions, but Anthropic did not publish indicators of compromise that outside researchers could use for full independent validation. Check Point noted that limitation in its broader analysis.

The Mexican government case contains extensive operational figures, including command counts, sessions, scripts, systems, and records. Yet public confirmation from every named or affected institution remains incomplete. Reporting should preserve that distinction.

There is also a measurement problem around autonomy. A model can execute many commands while a person still designs the framework, chooses targets, supplies credentials, and approves pivotal actions. Counting commands does not reveal who controlled the operation’s intent.

Anthropic’s 80% to 90% estimate concerns tactical work within a specific campaign. It does not mean the model owned 90% of every important decision. The company said humans intervened at several critical moments, which may have included choices with disproportionate strategic value.

Likewise, 5,317 AI-executed commands do not establish that every command was useful. Agents can repeat actions, encounter errors, or generate unnecessary steps. Raw volume captures activity, not competence.

AI systems also make mistakes that can expose attackers. They may misread output, choose noisy techniques, fabricate findings, or document sensitive details too thoroughly. Check Point discovered aspects of VoidLink partly because development artifacts and operational mistakes created visibility.

Provider controls can still matter. Abuse monitoring sees patterns across accounts that an individual target cannot observe. Rate anomalies, repeated exploitation prompts, suspicious tool use, and shared infrastructure can support investigation and disruption.

The AI threat mapping published by Anthropic analyzed 832 accounts banned for cyber-related policy violations between March 2025 and March 2026. It found that 560 accounts, or 67.3%, used AI for malware-related preparation.

Most observed actors were not operating at GTG-1002’s level. Anthropic found that agentic scaffolding, meaning the software and architecture surrounding a model, distinguished the highest-risk activity more clearly than the number of techniques requested.

That finding supports a restrained conclusion. AI-assisted abuse is broad, but deeply autonomous operations remain a more advanced subset. The danger lies in that subset becoming easier to reproduce.

Google News distribution can flatten these distinctions into a dramatic headline. “AI runs cyberattacks” is directionally useful but technically incomplete. Human intent, vulnerable systems, stolen access, orchestration code, and weak controls still shape every documented case.

Defenders should neither dismiss the incidents as marketing nor treat autonomous compromise as inevitable. The evidence supports investment in faster detection, stronger agent governance, and basic security controls. It does not support abandoning human review or granting defensive agents unlimited access.

Three Signals to Watch Next

The next test is whether agentic attacks become repeatable across actors, targets, and model providers.

The first signal is independent incident verification. Security researchers should look for cases where endpoint data, network records, provider telemetry, and victim reporting all confirm an agent’s live operational role. Repeated evidence across unrelated investigations would strengthen Check Point’s thesis.

Public indicators also matter. They let other organizations search their environments and allow independent teams to test attribution. If future reports remain dependent on one provider’s internal observations, confidence in the broader trend will grow more slowly.

The second signal is provider action against persistent agent manipulation. Coding assistants automatically consume repository files, tool descriptions, and project context. Providers need clearer trust controls for those inputs, including warnings, permission boundaries, provenance indicators, and restricted execution.

Watch whether commercial agents begin separating untrusted content from operational instructions by default. Stronger isolation would weaken attacks that rely on planted configuration files. Continued bypasses across several products would strengthen the case that agent architecture remains the durable weak point.

The third signal is defender response time. Organizations should measure how long they take to inventory an exposed service, apply a patch, revoke credentials, investigate suspicious tool activity, and contain lateral movement. Those operational metrics reveal whether defense is adapting to faster attacks.

A growing gap between disclosure and remediation would favor attackers, even without more capable models. A shrinking gap would show that automation, prioritization, and governance can offset some of the agentic advantage.

Security leaders should also distinguish approved AI use from malicious activity. Check Point says the average organization in its dataset used 10 AI applications monthly, often without formal approval. It reported that high-risk prompts doubled from 2% to 4% during the prior year.

Those prompts may contain corporate, personal, regulated, or credential-related information. Most represent ordinary employee behavior rather than an intrusion. The security program therefore has two connected jobs: stop adversaries using AI and govern employees using it.

A blanket ban rarely provides reliable visibility. Staff may switch to personal accounts or unapproved services. Organizations need clear data rules, approved tools, access controls, logging, and workflows that preserve context without exposing sensitive material.

Teams reviewing a fast stream of security findings also need durable internal evidence. A searchable engineering knowledge base can connect advisories, asset ownership, incident decisions, and remediation records without relying on scattered conversations.

The practical question is not whether every Google News warning predicts an autonomous breach. It is whether your organization can identify an agent moving through systems before its operator reaches the next critical decision. Review where AI agents run, what they can access, and which actions bypass human approval. Then test whether your team can contain a machine-paced intrusion with current tools and staffing.