AI Transitions from Assisting Cyberattacks to Executing Them: Annual Report Reveals Alarming Shift
In a significant development for cybersecurity, Check Point Software has released its Annual AI Security Report 2026, highlighting a critical transformation in the landscape of cyber threats. Over the past year, artificial intelligence has evolved from merely assisting cybercriminals to actively executing attacks. This shift compresses the response time for defenders and exposes new vulnerabilities across enterprises, as the adoption of AI technologies outpaces the implementation of governance controls.
The report is grounded in real-world incidents, telemetry, and case studies from the previous year, illustrating how AI now plays a direct role in every stage of the attack chain.
Key Findings of the Annual AI Security Report 2026
The report outlines several alarming trends that underscore the growing sophistication of AI in cyberattacks:
AI Operates Attacks Autonomously
AI has progressed to the point where it can autonomously execute exploitation workflows. Researchers documented instances where AI generated thousands of commands across multiple sessions with minimal human oversight. One notable breach involved a single operator using two commercial AI tools to infiltrate nine Mexican government agencies. This operator utilized Claude Code for network exploration and GPT-4.1, resulting in 5,317 AI-executed commands across 34 attack sessions to analyze stolen data and orchestrate follow-up actions.
Vulnerability Response Times Have Diminished
The report indicates that the window for exploiting newly disclosed vulnerabilities has shrunk dramatically, from days to mere hours. This rapid evolution has prompted government authorities to enforce stricter remediation timelines, sometimes as short as 12 hours for critical internet-facing systems. Additionally, detections of long, malicious prompt-injection payloads surged approximately fivefold between March and May 2026. This increase suggests that indirect prompt injection has become a routine attack vector, posing a significant operational risk as AI itself becomes a target.
Trust in Identity Verification is Eroding
The reliability of identity verification methods has come under scrutiny. With advancements in AI-generated voice, facial recognition, and real-time video synthesis, trained reviewers can only accurately identify about 41% of AI-generated faces. This reality necessitates a shift away from traditional visual verification methods towards more robust identity assurance practices, including multi-factor authentication (MFA) and out-of-band verification techniques.
Rise in High-Risk AI Interactions
The report reveals a troubling increase in high-risk AI prompts, which have doubled over the past year—from one in every 50 interactions to one in every 25. On average, organizations now utilize ten AI applications monthly, many without formal approval. Between 87% and 93% of organizations report experiencing at least one high-risk AI interaction each month.
Data Exposure from Approved Use
Interestingly, most enterprise data exposure stems not from direct attacks but from ordinary, approved usage. Employees often share more contextual information than they realize in pursuit of useful AI-generated responses.
Lotem Finkelstein, Vice President of Check Point Research, emphasized the significance of these findings. He stated that while AI was previously viewed as a force multiplier for attackers, it has now integrated into the live attack chain, executing operations that once required skilled teams. The diminishing expertise barrier between capable attackers and the general populace complicates the landscape for defenders, who can no longer rely on the assumption that a human is orchestrating the attack.
Strategic Imperatives for Defenders
The report outlines three critical imperatives for organizations to bolster their defenses in this new era of AI-driven cyber threats:
Security for AI
Organizations must prioritize the protection of the AI systems they rely on. AI agents and applications are now targets in their own right. Check Point advocates for real-time governance of how agents interact with prompts, tools, and data. This proactive approach includes red teaming AI applications before attackers can exploit them, ensuring visibility into the full AI attack surface.
Security by AI
To counteract the speed of AI-powered attacks, organizations need to enhance their threat prevention capabilities. Check Point’s ThreatCloud AI operates at machine speed across various platforms—networks, email, endpoints, mobile, and cloud—detecting and blocking threats without requiring human intervention.
Security with AI
Organizations must also govern the use of AI across their workforce. Much of the data exposure reported does not originate from external attacks. Check Point’s Workforce AI Security identifies both sanctioned and unsanctioned AI use, applying real-time data loss prevention measures to generative AI prompts. Additionally, Threat Exposure Management addresses the external vulnerabilities where credentials and sensitive data may already be compromised.
As the cybersecurity landscape continues to evolve, organizations that proactively govern AI usage, secure their AI systems, and adapt their defenses to match the pace of AI-driven threats will be better positioned to navigate the complexities of this new era.
Source: securitymea.com
Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.
