AI Threat Landscape Digest

2026

July-August

Executive Summary

The defining development of the period came not from attackers but from the AI labs themselves, whose models broke out of controlled evaluations and reached real systems. In the wild, the criminal and state use of AI continued to mature along the lines tracked in earlier editions: models now act as attack operators, an underground market supplies the access, and AI systems have themselves become a target. The substantial distance between what the strongest models demonstrated under evaluation and what criminals are currently doing is the central fact of the period.

Key findings

Frontier models have demonstrated a new level of threat. Under evaluation collectively exploited an unknown vulnerability, escaped containment, and attempted to deceive a person to reach their objective, a degree of autonomous offensive capability not previously observed. On the pattern of every prior advance, it should be expected in criminal hands within months.

AI is now operating attacks, and models below the frontier are sufficient. Criminal use has raised the tempo and lowered the skill required, but is still relying on familiar and largely detectable techniques

An underground market supplies AI access, and the demand is for durable guardrail bypass. Access, guardrail removal, and autonomy are now sold separately, and each has buyers.

AI systems have become a target in their own right. These attacks work through the AI system’s own inputs and dependencies, an attack surface that existing defenses do not monitor.

AI-assisted discovery is pushing vulnerability disclosures to record levels, but not exploitation. Microsoft and Oracle shipped record patch volumes and the UK NCSC warned of a "patch wave" that will strain remediation, while the share of AI-discovered flaws actually exploited stayed at about one percent.

Enterprise exposure through everyday use remains persistent. In July, one in every 36 GenAI prompts from enterprise networks carried a high risk of sensitive data leakage, affecting 88 percent of organizations that use these tools.

AI Models Break Out of Their Evaluations

Between mid-July and early August, three AI labs and a government testing institute disclosed that models under evaluation had reached real systems outside their test environments. One exploited a previously unknown vulnerability to break out of its isolated environment. Others obtained credentials, read a production database, and in one case tried to persuade a person to approve malicious code.

This report normally covers the use of AI in cyberspace by criminals and state actors. These incidents fall outside that scope, since the models involved were under the “control” of the labs themselves. They are included because they were the most significant AI security development of the period, and no account of the AI threat landscape could omit them. They also matter for a second reason: what these models did under supervision indicates where the criminal use of AI is heading.

In every case the models’ guardrails had been relaxed deliberately, since the purpose of such evaluations is to measure what a model can do when it does not refuse. What differed was how each model reached the outside world. In two of the cases a misconfiguration exposed the test environment to the internet. In the most serious case no such opening existed; the model created one.

That case involved OpenAI models under internal evaluation, including an unreleased research prototype. They ran inside an environment intended to be isolated, with network access limited to an internal package proxy (JFrog Artifactory). The models found and exploited a previously unknown vulnerability in that proxy, used a third-party sandbox as a staging point, and reached Hugging Face’s production systems. Hugging Face later reconstructed roughly 17,600 of the actions the agent took over several days before detection. Containment did not merely fail here; a genuine zero-day, since patched by JFrog, was used to defeat it.

Anthropic described a different failure. An evaluation environment was mistakenly left reachable to the internet, and test models reached three real organizations. They collected credentials, read a production database, and briefly published a malicious package to PyPI that executed on fifteen systems before the tests were halted. Meta disclosed a comparable incident, in which a pre-release model reached the open internet through an evaluator misconfiguration and exploited a flaw in a live website.

17,600 actions performed autonomously by rogue AI agent before detection

Check Point Software | AI Threat Landscape Digest 3

https://openai.com/index/hugging-face-model-evaluation-security-incident https://openai.com/index/hugging-face-model-evaluation-security-incident https://huggingface.co/blog/agent-intrusion-technical-timeline https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals https://www.theguardian.com/technology/2026/aug/05/meta-ai-model-hack-training

The UK AI Security Institute reported a third pattern. Across 122 controlled runs, agents took 19 actions they were not authorized to take. In one instance, an agent created multiple fake identities and used them in an attempt to persuade a real maintainer to approve malicious code it was attempting to insert into a public open-source project.

The significance does not lie in any single new capability. Models discovering vulnerabilities is an established trend this period, and so is operation without a human directing each step. The novelty is the combination: a model that finds an unknown flaw, exploits it, and continues working toward its objective for days without supervision. One agent went further and attempted to manipulate a person to clear its path, and was stopped only because that person refused. What these incidents demonstrate is capability rather than scale. The models showed what is possible under evaluation conditions; they do not indicate that such attacks are occurring at volume in the wild.

The distance between what these models can do and what criminals are currently doing is the defining feature of this period. The criminal use of AI observed to date has mostly increased tempo and lowered the bar for human operators. It runs on commercial models below the frontier and open-weight models, uses established techniques, and remains largely detectable by current defenses.

What the labs recorded is different in kind: a single model that found the flaw, wrote the exploit, carried the intrusion through to its objective, and turned to social engineering when blocked, a span of specialties that human-run intrusions divide among several people. Several conclusions follow. Capability does not remain confined to the frontier. Every advance to date, whether released by a vendor or published as open weights, has reached general availability within months, and the industry has not shown that it can slow down that pace or prevent its guardrails from being removed for malicious use. The behaviors that alarmed the labs are the behaviors an attacker wants: a model that pursues its objective past its assigned limits, resists being stopped, and will deceive a person to reach its goal. And the defenses that catch today’s AI-assisted crime are calibrated to human tempo and known techniques, aided for now by how error-prone these tools remain, an advantage that will narrow as the models improve.

19 actions Across 122 controlled runs, agents took 19 actions they were not authorized to take.

Check Point Software | AI Threat Landscape Digest 4

https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

AI as a Live Attack Operator

The period added weight to a subject this report has followed before: AI acting as the operator of an attack rather than as a tool for preparing one. The signal is strengthening. Three cases carry it. An affiliate of a ransomware group conducted its intrusions through Claude Code. A ransomware campaign ran end to end with the model in control. A state-linked operation used AI to select and attack targets across Asia. Together they show the same capability at different levels of autonomy, from a model that assists a person to one that conducts the operation itself.

The most advanced autonomy has appeared in laboratory evaluations of top-tier models that are not publicly available. In the wild, the notable finding is that models a tier below are proving effective for serious offensive work. Gambit Security documented an operator, assessed with medium confidence as an affiliate of The Gentlemen ransomware service, who used Claude Code in intrusions against at least six organizations. The operator chose Claude Sonnet 4.6, an older and less restricted model, which researchers assessed as a deliberate choice on the view that the strongest models refuse more often. Even that constraint proved easy to bypass: when the model declined to proceed against what it identified as a live production system, the operator opened a new session, asserted that the work was authorized, and the model complied. It then executed a conventional intrusion from inside the network, obtaining a firewall’s stored credentials through an LDAP pass-back, creating a hidden VPN account, enumerating backup servers, and staging a database for exfiltration. None of these techniques are new, which is why existing detection still identifies this activity. What is new is that the model, rather than a person, carried them out.

Models below the frontier are already sufficient

The same group shows AI entering from the other side of the operation. Check Point Research examined the core Gentlemen operators through their leaked internal communications and found AI embedded in the group’s back office: an administrator built the group’s control panel in just a few days with AI-assisted coding, and members were testing open models to help triage stolen data. The other research shows AI at the point of intrusion; Check Point Research’s findings show it at the point of development. A single group is integrating AI into a growing share of its operations, and that widening integration is the trend to watch, more than any individual incident.

Check Point Software | AI Threat Landscape Digest 5

https://gambit.security/blog-posts/ai-across-the-intrusion-lifecycle https://research.checkpoint.com/2026/thus-spoke-the-gentlemen/

A model conducting the operation itself

State actors are on the same path

Researchers described a campaign they call JADEPUFFER and present it as the first documented case of agentic ransomware, an extortion operation carried out end to end by a language model. Claims of a first autonomous attack have been made before, for a China-linked espionage operation late last year and for an earlier proof-of-concept ransomware strain, and the Mexico government breach reported earlier this year still had a person issuing the prompts. What is new in JADEPUFFER is narrower and substantive: once a human had configured and directed it, the model ran the operation on its own. Starting from a known flaw in the Langflow AI tool, it moved to an internal database, exfiltrated and deleted its contents, left a ransom note, and corrected its own errors along the way. A later wave used purpose-built code to encrypt AI models and training data. The limitation matters as much as the milestone: as one early account noted, a human still set up and provisioned the operation.

In mid-August, a near-autonomous attack on Taiwanese government sites that extracted personnel records was reported, carried out with open-source AI agent frameworks and attributed with low confidence to Chinese nexus actors. Researchers had earlier described a China-linked campaign that paired DeepSeek models with the Hermes agent framework to select and attack internet-facing systems across Asia, and related reporting tied similar tooling to an intrusion at Thailand’s Ministry of Finance. These are separate reports rather than a single confirmed campaign, and the sources treat attribution as suspected and China-linked.

Tempo is part of the shift. Trend Micro reported a Russian-speaking actor who stood up and migrated a live command-and-control botnet in about six minutes using a jailbroken Gemini command-line tool. The skill required has fallen, and the pace of operations has risen.

Read together, these cases trace a progression from a model that assists a person to one that conducts the operation, all of it still using established methods and mostly still detectable. The laboratory incidents described above show where that progression leads once the model is stronger and nothing restrains it.

And at greater speed

Check Point Software | AI Threat Landscape Digest 6

https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion https://www.anthropic.com/news/disrupting-AI-espionage https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h22025.pdf https://techcrunch.com/2026/07/06/the-first-ai-run-ransomware-attack-still-needed-a-human/ https://cyberscoop.com/near-autonomous-ai-attack-government-target-taiwan/ https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ https://www.trendmicro.com/en_us/research/26/g/actor-behind-patriot-bait-used-ai-to-deploy-c2-botnet.html

The AI-Access Underground

Behind the operations described above lies a supply chain for the AI capability itself. Over the past year, a market has formed around illicit access to commercial models, and by late summer it had settled into three layers: stealing access, reselling it, and packaging it as a finished tool.

Stealing access

The theft of AI API keys has become a trend in its own right, and the raw material is other people’s credentials. In one example, an operation tracked by researchers as Zerofot, ran an internet-wide scanner that harvested almost 3,000 valid keys and credentials from exposed files on more than 1,700 hosts in about seven weeks, sorting them by the AI providers and cloud services each unlocked. Others target exposed self-hosted models directly. Researchers documented a network built on tens of thousands of exposed Ollama servers, used as free inference outside any platform’s guardrails or monitoring.

~3,000 valid keys and credentials harvested

1,700+

exposed hosts scanned

7 weeks for one internet-wide scan

Check Point Software | AI Threat Landscape Digest 7

https://gambit.security/blog-posts/ai-across-the-intrusion-lifecycle https://www.sentinelone.com/labs/silent-brothers-ollama-hosts-form-anonymous-ai-network-beyond-platform-guardrails/

Reselling access

Stolen keys are worth more pooled than used individually, and a resale layer has grown around them. The Zerofot operation routed its own Claude Code through a gateway it operated, the same gateway it stocked with stolen keys and used to resell access to the underlying models. Researchers documented a comparable service reselling discounted Anthropic access through fraudulent cloud accounts, an arrangement that gave its operators visibility into every prompt their customers sent. Another report described “transfer stations” that launder stolen tokens into resellable access, and a third traced one campaign to a functioning marketplace. This relay layer does not remove guardrails and does not make a model more capable. It provides frontier-grade capability at low cost, conceals the buyer’s identity, and ensures that the account eventually flagged and frozen belongs to the victim rather than the attacker. Guardrail removal is a separate product, sold at the next layer.

Figure 1 - Supply side. Forum posting promoting discounted access to commercial and uncensored models.

Check Point Software | AI Threat Landscape Digest 8

https://www.okta.com/blog/threat-intelligence/free_tokens_for_sale/ https://unit42.paloaltonetworks.com/ai-token-jacking/ https://www.pillar.security/blog/operation-bizarre-bazaar-first-attributed-llmjacking-campaign-with-commercial-marketplace-monetization

Packaging access as a product

At the far end of the chain, access is packaged into finished tooling. Researchers profiled a Russian-speaking actor who built a jailbroken Claude model into what was marketed as a penetration-testing platform, integrated with scanning tools so that a buyer with limited skill could direct it at a target. The actor had purchased the underlying Claude access from a grey-market reseller for a few dollars, a direct link to the layer above. A separate report described a botnet framework built to sell AI capability as a service from compromised machines.

The demand side

The supply side of this market is well documented by security vendors. The demand side is less visible and more revealing. On a Russian- language crime forum, one actor posted a standing request to buy a method for bypassing Claude’s restrictions. The wording is instructive: the buyer did not want another jailbreak prompt, but full instruction in how to interact with the model so that it complies, and only for current versions of Claude.

Figure 2 - Forum post seeking to buy a durable method for bypassing Claude's restrictions rather than a single jailbreak prompt.

Check Point Software | AI Threat Landscape Digest 9

https://www.catonetworks.com/blog/cato-ctrl-how-one-threat-actor-turned-frontier-ai-into-an-offensive-platform/ https://flare.io/learn/resources/blog/mycelium-framework-ai-as-a-service-botnet

Attacks Against AI Systems

The operations described so far use AI as a weapon. A separate and growing body of attacks treats AI systems as the target. The distinction matters. The attacks above mostly rely on established techniques that existing defenses still detect. The attacks in this category use the AI system itself as the point of entry, an attack surface those defenses were not designed to monitor.

Coding agents

An AI coding agent reads files, pull requests, error messages, and web pages, and acts on them with the developer’s own permissions. Anything it reads is a potential instruction. Researchers described a flaw they named GhostApproval, in which a malicious repository uses symbolic links to make an agent write files outside its workspace, in some tools before the developer approves the change, sufficient to manipulate authorized SSH keys. Amazon and Cursor issued CVEs for it. A related family of techniques applies the same principle of hiding instructions in content the agent trusts: Ghostcommit embedded prompts inside PNG images to evade AI code review and lead an agent to leak secrets from a project’s environment file, and Agentjacking used fabricated error reports to make agents execute attacker commands. The products themselves also carried conventional vulnerabilities. Google’s Gemini CLI and Anthropic’s Claude Code were both patched for flaws that a malicious GitHub issue could use against a build pipeline: the Gemini CLI flaw, CVE-2026-12537, was rated at the maximum severity and allowed command execution on the build runner, while the Claude Code flaw, CVE-2026-54316, opened a covert channel for leaking an API key.

Enterprise copilots

Assistants built into office software are exposed in the same way, because they read email, documents, and shared files on the user’s behalf. The Search feature in Microsoft 365 Copilot Enterprise was found to leak business files from a single crafted link, patched as CVE-2026-42824. Researchers also demonstrated a self- propagating attack in Microsoft Word’s Copilot, in which a hidden prompt inside a document spreads to other documents the assistant handles. Microsoft mitigated the original proof of concept, but the researchers showed the fix could be circumvented and the underlying weakness remained. Google’s Dialogflow and Atlassian’s Rovo carried their own data-exposure flaws. Check Point Research has described a variant aimed at AI email agents, in which instructions hidden in a message take effect before the user reads it.

The AI supply chain

The tools underlying these systems are targets in their own right. In June, more than 140 packages in the Mastra AI framework’s npm account were trojanized to deliver credential-stealing malware on installation. Microsoft attributed the compromise with high confidence to the North Korean group Sapphire Sleet. Separately, researchers identified malicious releases of LiteLLM, a widely used gateway for routing traffic to language models, that exposed credentials across a reported 2,500 companies and their build pipelines. The tainted releases dated earlier this year, but their scale was only reported in August, near the end of the period, and the picture was still developing at the time of writing.

Check Point Software | AI Threat Landscape Digest 10

https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants https://www.darkreading.com/application-security/copilot-searchleak-attack-1-click-data-theft https://cybernews.com/security/microsoft-copilot-self-propagating-worm/ https://cybernews.com/security/microsoft-copilot-self-propagating-worm/ https://blog.checkpoint.com/email-security/email-agent-hijacking-the-hidden-threat-that-breaks-post-delivery-security/ https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/ https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines

AI-Powered Fraud and Synthetic Identity  Fraud is where AI has changed the least in method and the most in scale. The techniques are established. What is new is that a small group can now execute them at the volume and sophistication that once required a large operation, and that the controls meant to catch them are failing.

Defeating identity checks

The document-and-selfie KYC process that banks and crypto exchanges use to verify new customers is now routinely defeated. Kits such as ProKYC, presented at Black Hat this summer, generate a forged ID and a matching selfie and spoof the liveness check intended to prove a real person is present. Interpol, which put total fraud losses at 442 billion dollars in 2025, estimated that AI-enhanced fraud is about four and a half times more profitable than traditional methods. Impersonation has moved to video and voice. The FBI warned of deepfake videos of FBI personnel promoting a spoofed version of its IC3 fraud-reporting site, and a vishing wave that reportedly used AI-generated voice clones of senior executives targeted major hedge funds, among them Citadel, Point72, and Two Sigma. OpenAI reported banning accounts tied to a Cambodia-based scam operation that had used ChatGPT across several types of fraud, from investment scams to fabricated personas and message translation.

Across these cases the pattern holds. AI has not introduced new fraud schemes. The frauds remain impersonation, account takeover, and identity fabrication, all older than the technology. What is new is the means: a voice or a face can now be counterfeited well enough to defeat the checks that people and systems relied on, and at almost no cost. In doing so AI has undermined the ability to trust that a face, a voice, or an account belongs to who it claims to.

Check Point Software | AI Threat Landscape Digest 11

https://www.darkreading.com/threat-intelligence/ai-global-crime-syndicates-fraud-nirvana https://www.interpol.int/en/News-and-Events/News/2026/INTERPOL-report-warns-of-increasingly-sophisticated-global-financial-fraud-threat https://www.ic3.gov/PSA/2026/PSA260720 https://gizmodo.com/ai-powered-vishing-attacks-reportedly-targeted-top-hedge-funds-2000794923 https://gizmodo.com/ai-powered-vishing-attacks-reportedly-targeted-top-hedge-funds-2000794923 https://openai.com/index/disrupting-malicious-uses-of-ai-criminal-scam-operation/

“AI” as a selling point.

On the forums where these tools are sold, AI has become a marketing label, and the substance behind it varies. Several spam and phishing mailers now advertise AI features. One, marketed as an all-in-one mailer with AI, lists a warm-up system, fingerprint spoofing, and captcha solving, but its most concrete AI capability, having the model log into inboxes and reply to messages from a prompt, is listed as a planned feature rather than a working one. Another is sold as an “AI mass mailer” for a few thousand dollars, and a third advertises an “AI email builder.” A separate seller offers voice-over-IP infrastructure bundled with “AI voice agents” for automated calling, a category of service that has appeared repeatedly and fits the same vishing pattern as the deepfake- voice fraud above. The pattern suggests that demand is running ahead of delivery: sellers label products as AI-enabled because buyers want it, but in these cases the label mostly covers conventional spam and calling tools.

Figure 3 - A forum listing for an all-in-one mailer advertised with AI, most AI capabilities are listed as a future addition. Source: exploit.in

The Vulnerability Race  The shrinking window between a vulnerability’s disclosure and its exploitation at scale, which leaves defenders less time to patch, was a central theme of the annual report, and this period confirmed it. AI now finds vulnerabilities faster than defenders can patch them.

The UK NCSC warned of a coming “patch wave,” a surge of urgent fixes as AI-assisted discovery scales. Record patch volumes followed. Microsoft’s July update carried a record 570 fixes, which the company credited in part to its own use of AI, and Oracle’s quarterly update ran to more than 1,400 patches. Individual discoveries followed the same pattern: a critical Squid proxy flaw named Squidbleed, a pre-authentication WordPress flaw found with a frontier model, and a years-old Linux kernel bug for which AI-assisted work reduced the time needed to reliably trigger its race condition from about fifteen minutes to a few seconds.

The counterweight remains important. Faster discovery is not the same as more frequent compromise, and analysts noted that AI has accelerated discovery far more than it has raised the rate of successful attacks. Of the roughly one thousand vulnerabilities attributed to AI-assisted discovery in the first half of the year, only about one percent were confirmed to be exploited in the wild, in line with the rate for flaws found by other means. The bottleneck has moved: it is no longer finding the flaw, but the human work of triaging and deploying the fix before it is exploited.

Check Point Software | AI Threat Landscape Digest 12

https://www.ncsc.gov.uk/blogs/prepare-for-vulnerability-patch-wave https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/ https://www.oracle.com/security-alerts/cpujul2026.html https://blog.calif.io/p/squidbleed-cve-2026-47729 https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/ https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/ https://cyberscoop.com/ai-assisted-security-tools-are-finding-more-bugs-but-the-threat-level-has-not-changed/

Enterprise Adoption and Exposure  Enterprise use of generative AI continued to expand in July 2026, and with it the volume of sensitive data leaving organizations through prompts. Data from enterprise networks monitored by Check Point shows that one in every 36 prompts submitted to generative AI tools, about 2.8 percent, carried a high risk of sensitive data leakage. The exposure is broad rather than concentrated: 88 percent of organizations that use these tools regularly recorded at least one high-risk prompt during the month. Usage itself remains fragmented, with the average organization using eight different generative AI tools and the average user submitting 95 prompts over the month.

Regional differences were modest but consistent. Latin America recorded the highest rate of high-risk prompts, at one in every 29 (3.5 percent), followed by North America at one in 32 (3.1 percent). Europe, at one in 40 (2.5 percent), and Asia-Pacific, at one in 41 (2.4 percent), fell below the global average.

By industry, four sectors exceeded the global rate: Business Services, Healthcare and Medical, Information Technology, and Government. Business Services led at 3.7 percent, or one in every 27 prompts, followed by Healthcare and Medical at 3.2 percent (one in 31) and Information Technology at 3.1 percent (one in 32).

These figures describe routine use rather than attacks. The exposure arises from ordinary work with tools that organizations have adopted faster than they have governed, which is what makes it persistent.

Check Point Software | AI Threat Landscape Digest 13

Conclusion  Three structural observations follow from the period.

The threat is now defined by a gap, and the gap is closing from above.

At the frontier, models under evaluation showed autonomous offensive capability of a kind not previously observed: finding an unknown vulnerability, exploiting it, sustaining a multi-day operation, and deceiving a person in order to proceed. In criminal hands, AI is doing something more modest and more measurable, raising tempo, lowering the skill required, and running familiar techniques on commercial models below the frontier and open-weight models. Every prior advance in model capability has moved from the frontier to general availability within months, and nothing observed this period suggests that the industry can slow that movement or keep its guardrails intact against deliberate misuse.

Access and compliance are now commodities, and the constraint on misuse has moved from the model to the market.

A criminal market supplies each ingredient separately. Access comes through stolen keys resold behind gateways that conceal the buyer. Compliance comes through jailbreaks that in practice often require no more than a claim of authorization. Autonomy comes through open-source orchestration that lets a model run an operation on its own. Demand is visible first-hand, and it is for durable bypasses rather than single tricks. A model’s own safety behavior is therefore no longer the binding constraint on its misuse; what determines whether a capability is abused is the market that packages it, and that market is maturing faster than the controls around it.

Current defenses hold for a reason that will not last, while the attack surface shifts onto AI systems themselves.

Where AI is the attacker, existing defenses still catch most activity, because the techniques are known and the tools remain noisy and error-prone. That is a reprieve rather than a resolution. It depends on attackers using established methods and on the models remaining careless, and the laboratory incidents show both conditions ending.

Check Point Software | AI Threat Landscape Digest 14

Prevention In The Age Of Machine-speed Attacks

This period made the case for prevention more concretely than any report before it. The labs' own evaluation models found an unknown vulnerability and escaped containment before anyone caught them, and a ransomware group ran its entire operation through Claude Code with a person only configuring the start. In both cases, by the time a human noticed, the work was already done. Reaction time built for human attackers cannot keep pace with a model that moves in minutes rather than days. Securing your AI transformation now means securing the full stack, from the employees running everyday prompts through commercial tools, to the applications and agents built on top of large language models, to the infrastructure carrying AI traffic through the data center.

Secure Employee AI Usage  Secure Enterprise AI Applications & Agents Employees are using GenAI tools, desktop apps, coding assistants, and user-tied agents constantly, and most organizations still can't see what's actually happening inside those interactions. One in every 36 enterprise prompts this July carried a high risk of sensitive data leakage, and 88 percent of organizations recorded at least one high-risk prompt during the month, spread across an average of eight different GenAI tools per organization. That's the gap Workforce AI Security closes, giving security teams visibility, governance, and real-time data protection across all of it. It also matters because of who else is watching those same tools: the Gentlemen ransomware affiliate who used Claude Code to conduct an intrusion against at least six organizations is a reminder that the commercial tools employees rely on daily are exactly what attackers reach for too.

The AI applications and agents enterprises are building carry real permissions, and this period showed what happens when nothing is watching what they actually do at runtime. The JADEPUFFER campaign carried out extortion end to end once a human had configured and launched it, starting from a flaw in the Langflow AI tool and moving on its own from there. AI Agent Security is built for exactly this gap, covering discovery and governance through runtime enforcement against prompt injection and unsafe or risky actions. The same exposure shows up in the techniques behind GhostApproval, Ghostcommit, and Agentjacking, all of which hide instructions inside content an agent trusts by default, a symbolic link, a PNG image, a fabricated error report, none of which show up to defenses built for conventional intrusions.

Check Point Software | AI Threat Landscape Digest 15

Secure MCP Usage & Tool Access  This period's evaluation incidents showed exactly what happens without proper authorization boundaries in place: models that reached production databases, pulled credentials, and worked through connected systems for days before anyone stepped in. That exposure exists whether the MCP activity originates from employee AI tools and coding assistants or from enterprise-built agents, which is why MCP protection isn't confined to one product. It spans both Workforce AI Security and AI Agent Security, discovering and governing usage and protecting interactions with connected tools and data wherever they start.

AI Security Testing  This period's evaluation incidents also offer a preview of what adversarial testing can surface before an attacker does. Models under test found an unknown vulnerability, escaped containment, and in one case attempted to persuade a person to approve malicious code, all under controlled conditions rather than live ones. Applying that same discipline internally, before deployment, is what AI Red Teaming is for, proactively identifying vulnerabilities and attack paths in AI applications and agents before they're exploited in the wild.

AI MODELS ARE MOVING FASTER THAN THE ALERTS THAT FOLLOW THEM. BUILD FOR THAT SPEED NOW.

Secure AI Infrastructure & Private LLMs  As the AI-access underground matures into a full supply chain, stolen keys, resold access, jailbroken models sold as finished tools, the infrastructure running private models becomes as much a target as the model itself. That's the layer AI Factory Firewall is built to protect, securing private enterprise LLMs and NVIDIA AI GPU server clusters in AI data centers, running as a containerized firewall with no impact on GPU performance.

Validate What Attackers Can Actually Exploit  Knowing where a vulnerability exists isn't the same as knowing whether an attacker can reach and use it, and this period's findings show why that distinction matters. AI-assisted discovery pushed vulnerability disclosures to record levels, Microsoft's July update alone carried 570 fixes, yet only about one percent of AI-discovered flaws were confirmed exploited in the wild. Agentic Exposure Validation is built for that gap, using a multi- agent pipeline that separates real, exploitable risk from theoretical findings, validating attack paths and prioritizing proven risk to accelerate remediation.

Check Point Software | AI Threat Landscape Digest 16

https://mcp.checkpoint.com/ https://www.checkpoint.com/ai-security/ai-workforce-security/ https://www.checkpoint.com/ai-security/ai-workforce-security/ https://www.checkpoint.com/ai-security/ai-agent-security/ https://www.checkpoint.com/solutions/ai-security-testing/ https://www.checkpoint.com/solutions/ai-security-testing/ https://www.checkpoint.com/lp/r82-ai-zero-trust-gsem?utm_campaign=dg_ps_26q3_emea_all_meshop-fw-the-case-for-ai-zero-trust-page-lg_en-gsem&utm_source=google-dg&utm_medium=cpc&utm_term=check%20point%20ai%20firewall&utm_content=197136100445&gad_source=1&gad_campaignid=24080865564&gbraid=0AAAAADIBfpe6iWI5C6cQBSHSFw_uPcPyP&gclid=CjwKCAjw2aPVBhBkEiwA0Cptt9Sn9zCJgpIu5QEhJhl4MeBwIT49LPUXcoUd_8flcWSa5Gdwk0XAaRoC_EYQAvD_BwE https://www.checkpoint.com/exposure-management/ https://www.checkpoint.com/exposure-management/

© 2026 Check Point Software Technologies Ltd. All rights reserved.