AI Doesn’t Help Hackers Anymore. It Runs the Attacks Now

There was a time when the standard line on AI and cybersecurity was simple: AI makes existing attacks faster, cheaper, and easier to run. That framing was useful, and for a long stretch it was accurate. But the annual AI Security Report 2026 from Check Point Research documents a shift that goes a step further, and it’s the one I keep coming back to. AI has crossed from being an assistant to being an operator. Where it once helped attackers prepare, it now runs the operation itself.

That’s not hyperbole, and it’s not one vendor selling fear. The report is built on real incidents from the past twelve months: an attacker who ran two AI code agents to breach government agencies largely on autopilot, patch windows that collapsed from days to single-digit hours, and AI infrastructure suddenly becoming a target in its own right. This is the story I wrote earlier about how AI agents became a problem everyone suddenly has to care about, but on a bigger board.

The breach where the AI ran the job

The clearest example is the Mexican government intrusion that security firm Gambit Security uncovered in early 2026. Between December 2025 and February, a single operator used Anthropic’s Claude Code and OpenAI’s GPT-4.1 in parallel to break into roughly nine Mexican federal and state agencies. One model handled the live exploitation across dozens of sessions; the other analyzed the stolen data and automatically tasked follow-on activity.

The numbers are the point. More than a thousand prompts and over five thousand executed commands, with about three-quarters of the remote hack activity generated and executed by the model rather than typed out by a human. The operator set the architecture in motion; the AI ran the operation between check-ins. Gambit, the LA Times, and later coverage documented roughly 150 gigabytes of data and an estimated 195 million exposed records, covering taxpayer data, voter rolls, civil registry files, and government credentials. The whole campaign was reconstructed from Claude conversation logs the attacker had left publicly accessible.

Anyone who’s followed this space will recognize the pattern from Anthropic’s Claude publishing malware to PyPI while believing it was a simulation. The difference here is that it happened against real institutions at national scale, and the human was barely in the loop.

The patch window just collapsed

The quiet damage in the Check Point report is about time. AI can now reason about code well enough to generate working exploits at scale, which compresses the race on both sides. Google’s Threat Intelligence Group reported the first AI-assisted zero-day built for mass exploitation, and independent studies have shown frontier models producing working zero-day exploits reliably. A vulnerability disclosure that once gave defenders days now gives them hours.

Governments have started responding by changing the rules. The US CISA issued Binding Operational Directive 26-04 in June, ordering federal agencies to remediate the highest-risk vulnerabilities, those that are internet-facing, catalogue-listed, automatable, and grant full control, within three days. That’s the most aggressive standing patch timeline in federal history. India’s CERT-In went further, advising organizations to contain exploited flaws on internet-facing systems within twelve hours. Both are explicit acknowledgments that human-paced patching no longer matches machine-paced exploitation.

For anyone running infrastructure, this reframes how I think about the zero-trust conversation: it’s no longer enough to assume breach and segment well. You need to be able to find and fix a critical flaw in hours, which is why patching now has to be treated as a continuous, automated pipeline and not a quarterly maintenance window.

AI itself is now the attack surface

Here’s the part that catches people off guard. It’s not just that AI attacks worse people’s systems; AI systems themselves have become targets. Indirect prompt injection, where malicious instructions are hidden inside content an AI reads as part of its normal work, has moved from a proof-of-concept to a routine attack path. Check Point’s own telemetry recorded a roughly fivefold increase in detections of large malicious prompt-injection payloads between March and May this year.

The infrastructure is exposed too. The “Bleeding Llama” flaw in Ollama (CVE-2026-7482, CVSS 9.1) allowed an unauthenticated attacker to leak an entire Ollama process’s heap memory, including system prompts, environment variables, and other users’ conversation data. Cyera, The Hacker News, and security researchers converged on a figure of roughly three hundred thousand internet-facing Ollama servers, many listening on all interfaces with no authentication by default. The tool I use for local models on my own machine can become a liability precisely because it’s so easy to stand up and forget about.

Add to that a worm like Shai-Hulud, which in November 2025 compromised hundreds of widely used code packages and tens of thousands of repositories, quietly harvesting developer credentials as it spread through build pipelines. Your AI stack, your model servers, your agent control panels, and your code supply chain are all now first-class targets. A lot of this lands in the same bucket as the AI agents who hacked real companies this week using nothing cleverer than the tools the agent was given, which is why trust boundaries around agents matter more than the model’s raw capability.

Identity is quietly being dismantled

The report also documents how AI is hollowing out digital identity. Real-time face-swapping has moved from nation-state operations into industrialized fraud. One service sold more than ten thousand AI-generated fake IDs able to pass bank KYC checks across dozens of countries. Voice fraud platforms now run fully automated agents that walk targets through scripted account-recovery calls to steal one-time passcodes, with no human caller on the line and the jailbreak built into the product.

The most sobering example is North Korea’s IT worker program. US Treasury and law-enforcement actions, covered by CBS News, describe operatives using AI-fabricated personas, stolen identities, and forged documents to get hired inside legitimate Western companies as remote employees, generating close to eight hundred million dollars in a single year that funds weapons programs. When a fake voice can open an account and a fake persona can pass a remote interview, verification has to lean on more than a selfie and a name.

The quiet leak: data through approved use

What I found most worrying, though, is that most exposure in the report never came from an attack at all. High-risk generative AI prompts doubled from two percent to four percent over the past year. The average organization runs about ten AI applications a month, many without formal approval. Business Services had the worst rate of any industry, nearly one in every seventeen AI interactions carrying a real risk of sensitive data exposure, climbing to roughly one in fourteen by mid-2026.

That mirrors what I see every day: employees paste a support ticket, a snippet of internal code, or a customer record into a chatbot to get a useful answer, and the context they share for a good response goes far beyond what they’d ever put in an email. No attack required, no breach needed, just ordinary approved use quietly leaking credentials and source code. For developers this is easy to brush off until the day your own dependency tree gets compromised, which is exactly why detecting compromised npm packages is becoming a routine part of the job rather than an exotic one.

What this actually means

So what do you do with all of this? Three things, in my view.

First, accept that the defense has to run at machine speed too. If attackers can turn a disclosed vulnerability into a working exploit in hours, your patching and detection need automation behind them, not a human waking up on Monday. Second, get visibility into your own AI surface: your model endpoints, your agents, the apps your people actually use, not just the ones procurement signed off on. You cannot govern what you cannot see. Third, treat AI use itself as a data risk. If people are going to use these tools, give them a channel where they can paste sensitive context safely, instead of forcing them to do it quietly in the consumer app.

None of this means AI is doom. It means the threat model has genuinely changed, and the people who update theirs fastest win. The tools that used to be a force multiplier for attackers are now the attackers’ workforce, and the same is becoming true, blessedly, for defenders. As I noted when OpenAI paused Astra after it crossed a critical cyber threshold, the question was never whether these capabilities would arrive, but whether our safeguards would catch up in time. This report suggests the clock is running.