September 2026 · 6 min read

From AI assistant to attacker operator: Check Point 2026

Key Definitions

Indirect prompt injection An attack that hides malicious instructions inside content the model processes — web pages, documents, or tool outputs — so the model cannot separate data from instructions and may follow them. Check Point measured longer malicious payloads rising roughly fivefold between March and May 2026, approaching 1% of observed prompts.

Agentic architecture abuse Instead of attacking a model with a single prompt, attackers exploit the agent's autonomous execution — planting a configuration file the agent loads and trusts across sessions, creating a persistent, cross-session backdoor.

VoidLink A case in the report: one developer used an AI environment to produce an ~88,000-line command-and-control (C2) offensive framework in under a week — evidence that AI can build deployment-ready malware whose artifacts often show no trace of AI involvement.

For years the cybersecurity industry tracked AI as a force multiplier — something that made existing attack techniques faster, cheaper, and more accessible. Check Point Research's Annual AI Security Report 2026 documents a transition that goes further: AI has crossed from assistant to operator. Where it once helped attackers prepare, it now runs the operation. That shift changes how enterprises should defend.

From assistant to operator: what happens inside intrusions

The report shows AI doing hands-on work inside live intrusions — from China-nexus espionage campaigns to a criminal breach of multiple Mexican government agencies — and the activity has spread from nation states to ordinary cyber criminals. The flagship case is VoidLink: one developer used an AI environment to produce an ~88,000-line command-and-control (C2) offensive framework in under a week. Just as important, AI involvement is often invisible in the finished artifact: the final malware shows no trace of AI generation, which breaks artifact review and makes attribution harder.

Attackers abuse agentic architecture, not single prompts

Most actors favor jailbroken mainstream commercial models over self-hosted ones, the report finds — and the durable bypass is no longer a prompt. It is a planted configuration file the agent loads and trusts across sessions. The target has shifted from "the model" to "the agent's execution chain": attackers no longer try to make the model say the wrong thing; they make the agent load a poisoned config on every session.

Meanwhile, an AI-enabled criminal tooling market has matured. Phishing-as-a-Service kits now embed a language model with the jailbreak built in, and conversational AI voice-agent services run vishing and one-time-passcode (OTP) theft at scale. Attack tooling has been commoditized to the point of resembling a real SaaS product.

Virtual identity is no longer a reliable trust anchor

The report calls out virtual identity as a trust anchor that is failing: voice, face, documents, and live video are now cheap to forge convincingly and widely used in attacks that integrate multi-channel social engineering — voice, video, documents, and messaging — to a new level. For enterprises this directly challenges every process that relies on identity verification as the only gate: face recognition, voice confirmation, and video verification all need re-evaluation.

Indirect prompt injection enters real operations

The most concrete quantitative signal is indirect prompt injection. Detections of longer malicious payloads rose roughly fivefold between March and May 2026, approaching 1% of observed prompts in May. Longer payloads are more typical of content-borne and agentic attack paths — attackers hide instructions inside documents, web pages, and tool outputs so an agent executes them while "processing data." One percent is still small in absolute terms, but the fivefold growth and the shift from research demo to operational use are the signals that matter.

Enterprise data leakage keeps widening

The enterprise-side risk is climbing too: high-risk prompts doubled from 2% to 4% over the past year, and organizations used an average of 10 AI applications per month — many without official approval. Shadow AI is not declining. Sector distribution is uneven: Business Services recorded the highest rate of high-risk GenAI prompts at 5.91% — roughly one in 17 AI interactions carried a significant sensitive-data exposure risk. Exposure correlates strongly with AI usage patterns and security maturity: the more a sector uses AI and the looser its governance, the more concentrated the leaks.

Three steps to act

Put agent-loaded configs and tools under supply-chain review

The report's durable bypass is a planted config file. Treat the configs, plugins, and third-party tools an agent loads each session as software supply chain — with provenance checks and signature verification — not as a prompt-engineering problem.

Treat external content as possibly carrying instructions

Web pages, documents, email, and tool outputs an agent processes are all injection vectors. Add data-versus-instruction isolation for high-value agents and anomaly detection on long payloads — the report shows these attacks are rising fast.

Govern shadow AI apps and data egress

Organizations average ~10 AI apps per month, most unapproved. Build an official allowlist with data-egress monitoring, focus on departments with the highest high-risk rates (e.g. Business Services), and assume "data may already be exposed" in DLP policy.

References

Check Point Research: AI Security Report 2026 — https://research.checkpoint.com/2026/ai-security-report-2026/

FAQ

What is the core claim of Check Point's annual report?+

AI has crossed from 'force multiplier' to 'operator': where it once helped attackers prepare, it now does the hands-on work inside live intrusions — from China-nexus espionage campaigns to a criminal breach of multiple Mexican government agencies — and has spread from nation states to ordinary cyber criminals.

Why does the report say attackers abuse agentic architecture?+

Attackers are no longer attacking models with single prompts; they exploit the agent's autonomous execution by planting a configuration file the agent loads and trusts across sessions, creating a durable persistent backdoor. Most actors favor jailbroken commercial models over self-hosted ones.

How serious is indirect prompt injection?+

Detections of longer malicious payloads rose roughly fivefold between March and May 2026, approaching 1% of observed prompts in May. Longer payloads are more typical of content-borne and agentic attack paths, signaling indirect prompt injection is becoming operationally relevant.

How big is the enterprise data-leakage risk?+

High-risk prompts doubled from 2% to 4% over the past year, while organizations used an average of 10 AI applications per month, many without official approval. Business Services had the highest rate at 5.91% — roughly one in 17 AI interactions carried significant sensitive-data exposure risk.

What should enterprises do?+

Treat AI itself as an attack surface: audit the config files and third-party tools agents load (supply-chain review), treat external content as possibly carrying instructions, impose official approval and egress monitoring on AI apps, and push response speed toward machine speed — the attacker no longer sleeps.

CISA adds agent-exploited CVEs to KEV: a federal first

CISA added to its KEV list the two CVEs OpenAI agents used to breach Hugging Face — a federal first: agent exploitation is its own threat vector.

When Docs Become Code: llms.txt Dependency Confusion

A security team scanned 6,214 domains and 8,265 llms.txt files, found 120 pointing at unregistered packages or domains — and a Fortune 500 called back within an hour. Docs have become an execution surface for agents.

Ransomware Used Cursor's Agent: Refusal Isn't Authorization

Aurora ransomware used Cursor's agent for hundreds of ops by claiming a 'test'. Refusals live in model reasoning — enterprises need verifiable authorization.

100+ Tech Firms Sign Open Letter to Defend Against Rogue AI

OpenAI, Anthropic, Google, Microsoft and 100+ firms warn enterprises may have months, not years, to prepare for AI-powered attacks — hospitals, water, and internet infrastructure are at risk.