AI transitions from assistant to operator: 2026 AI safety report reveals attack paradigm shift

Introduction

For years, the cybersecurity industry has viewed AI as a "force multiplier": it makes existing attack techniques faster, cheaper, and more accessible. This description was once accurate. But the latest *AI Security Report 2026* published by Check Point Research documents a more profound shift—AI has transitioned from assistant to operator. Tools that once helped attackers prepare are now directly executing attack operations. From espionage activities linked to China to criminal intrusions targeting multiple Mexican government agencies, AI is performing the actual work of intrusions in real time. This trend is not limited to state actors; it has spread to ordinary cybercriminals.

Event Overview

• Date: July 14, 2026
• Publisher: Check Point Research
• Core Findings: AI shifts from development assistance to real-time attack operator; AI can build production-ready malware and attack toolkits; Attackers prefer commercial models and achieve persistent bypasses by exploiting agent architectures rather than single prompts; The AI crime tool market is mature; Forgery of virtual identities (voice, face, documents, real-time video) is extremely low-cost and widely used in multi-channel social engineering attacks; AI itself becomes an expanding attack surface; Indirect prompt injection attacks have increased significantly; The risk of enterprise data leakage through generative AI continues to rise.

Technology and Risk Analysis

Attack Method: AI Directly Controls Intrusions

The report indicates that AI can now perform the "hands-on" operations of real-time intrusions, rather than just generating phishing emails or writing code snippets. For example, in an espionage activity involving a China-linked organization, AI was used to automatically explore target networks, extract credentials, and move laterally. In another criminal case, an AI system breached the defenses of multiple Mexican government agencies and stole sensitive data. These operations were entirely AI-driven, with human attackers only providing direction in the initial phase.

Exploitation Chain: From Development Assistance to Production Deployment

A typical case is a C2 attack framework called "VoidLink," generated by a developer using an AI environment in less than a week, with 88,000 lines of code. AI involvement is almost invisible in the final product, but the entire development process was nearly completed by AI. This capability means attackers can quickly customize and iterate malware without deep programming skills.

Affected Assets: From Endpoints to Cloud Environments

AI attack targets encompass traditional endpoints, identity systems, cloud environments, and OT systems. Virtual identity forgery techniques enable attackers to bypass biometric-based authentication, posing a direct threat to the identity trust systems of remote work, financial institutions, and government agencies. Additionally, the supply chain risk of AI models themselves (such as indirect prompt injection) may affect all enterprise applications relying on GenAI.

Enterprise Impact Analysis

Operational Risk### Operational Risk

AI-driven attack automation means attack speed may exceed human response speed. Static security policies (such as signature-based detection) that enterprises rely on may be unable to effectively respond to dynamic, evolving AI attacks. For example, indirect prompt injection attacks increased approximately fivefold between March and May 2026, accounting for nearly 1% of all observed prompts. Such attacks can be triggered through malicious documents or web pages, affecting enterprise processes that use AI agents.

Financial Risk

The maturation of the AI crime tool market (e.g., phishing-as-a-service platforms with built-in jailbroken language models, voice AI agents running bulk voice phishing and OTP theft) lowers the barrier to attacks, leading to increased frequency and scale. Enterprises may face higher ransoms, data breach fines, and business interruption losses.

Compliance Risk

Enterprises using unauthorized AI applications (an average of 10 per month) exacerbates data breach risks. The proportion of high-risk prompts has doubled from 2% last year to 4%. In the business services industry, high-risk prompts account for as much as 5.91%, meaning that approximately one in every 17 AI interactions may leak sensitive data. This violates data protection regulations such as GDPR and CCPA, increasing the risk of regulatory penalties.

Brand Risk

The proliferation of virtual identity forgery (voice, face, ID documents, and real-time video can all be forged at low cost) makes it difficult for enterprises to verify the true identities of customers, partners, or even employees. Such attacks can lead to large-scale fraud incidents, severely damaging corporate reputation.

Data Risk

AI models cannot always distinguish between data and instructions; the content being processed may affect model behavior. If enterprises use GenAI to process internal documents, source code, or customer data, they face the risk of data theft or model poisoning via prompt injection.

Industry Trend Observations

This Is Not an Isolated Incident, but an Industry Trend

The shifts revealed in the *AI Security Report 2026* are no accident. Over the past few years, the role of AI in attacks has progressively escalated: from assisting in writing phishing emails, to generating malicious code, and now to fully automated intrusions. This change coincides with the maturation of AI agent technology. Attackers now tend to abuse the agent architectures of commercial AI models (rather than single-prompt jailbreaking) by implanting persistent configuration files to achieve cross-session bypass.

The AI Security Market Is Poised to Explode

As AI's own attack surface expands (models unable to distinguish data from instructions, supply chain risks, software vulnerabilities), AI security will become an independent market segment. Enterprises need specialized tools to detect prompt injection, monitor model behavior, and protect AI training data.

Identity Trust System Restructuring

Virtual identity forgery technology renders traditional "identity-based verification" trust models ineffective. Enterprises must shift to continuous verification (such as behavioral analysis, device fingerprinting, and upgraded multi-factor authentication) and reassess reliance on biometrics in remote identity verification processes.

Defense and Response Recommendations

Enterprise Level- Identity Security: Deploy anti-deepfake liveness detection technology, and use multi-factor authentication (MFA) combined with behavioral analysis for high-risk transactions. - Zero Trust Architecture: Assume the network is already compromised, enforce the principle of least privilege for all access requests, and continuously verify user and device identities. - Vulnerability Management: Prioritize patching vulnerabilities in AI frameworks, model deployment platforms, and the AI supply chain.

Technical Level

• AI Security Monitoring: Deploy dedicated tools to detect prompt injection, abnormal model behavior, and sensitive data leakage. Audit AI interaction logs.
• SIEM/XDR Integration: Incorporate AI security events into unified monitoring, correlate endpoint, network, and cloud logs to discover complex AI-driven attack chains.
• Threat Intelligence: Subscribe to emerging threat intelligence feeds covering AI attack techniques, such as Check Point Research's AI security reports.

Management Level

• Incident Response: Update incident response plans to include AI-related attack scenarios (e.g., prompt injection, AI-manipulated social engineering). Conduct red-blue team exercises.
• Security Governance: Establish AI usage policies that specify which data can be input into GenAI and which is prohibited. Implement data classification and access controls.
• Third-party Risk Management: Evaluate the security practices of AI service providers and require them to provide model security audit reports.