Check Point Report Finds AI Moving from Cyberattack Assistant to Operator

Summary

Check Point Research’s 2026 report says AI is increasingly used to operate intrusions, build malware, enable social engineering, and expose enterprise data, while indirect prompt-injection detections rose roughly fivefold from March to May.

Key points

• The report says AI has moved from assisting attack preparation to performing work in live intrusions, including espionage and criminal campaigns.
• One developer reportedly used an AI environment to produce VoidLink, an 88,000-line command-and-control framework, in under a week.
• Attackers increasingly abuse commercial AI agents through persistent configuration files, while phishing kits and voice-agent services use AI for phishing, vishing, and one-time-passcode theft.
• The report says forged voices, faces, documents, and live video are being used to strengthen multi-channel social engineering.
• Detections of longer malicious prompts rose roughly fivefold between March and May 2026, approaching 1% of observed prompts in May; the report links longer payloads to content-borne and agentic attack paths.
• High-risk prompts doubled from 2% to 4% over the past year, and organizations used an average of 10 AI applications monthly, many without official approval.
• Business Services had the highest reported rate of high-risk GenAI prompts, at 5.91%.

Tools

Industries