Check Point: AI Now "Operator" in Cyberattacks

AI has transitioned from an assistant to an operator in cyberattacks, according to the Annual AI Security Report 2026 from Check Point Research. It's now running operations, not just helping prepare them. AI now performs hands-on work in live intrusions, from espionage campaigns to breaches of government agencies. It has spread from nation-states to ordinary cybercriminals. AI is also building deployment-ready malware and attack suites. For example, one developer used an AI environment to produce an 88,000-line offensive framework in under a week. Attackers prefer commercial AI models, exploiting their architecture. They favor jailbroken mainstream models over self-hosted ones. An AI-enabled criminal tooling market has also matured, with phishing kits embedding language models and conversational AI voice agents running large-scale vishing. Virtual identity is no longer a reliable trust anchor, as voice, face, and video can be convincingly forged. AI itself is an expanding attack surface, with indirect prompt injection on the rise. High-risk prompts in enterprises doubled from 2% to 4% last year, and organizations use an average of 10 AI applications monthly. This shift means AI is now actively executing cyberattacks, posing a more direct and sophisticated threat to individuals and organizations.