AI now powers every cyberattack stage, Check Point says
The practical problem is not robot hackers; it is faster human intrusions with AI doing the tedious work at scale.
TL;DR
NextGov/FCW reports that Check Point research found artificial intelligence used across reconnaissance, exploitation, lateral movement and data theft, including criminal groups breaching government agencies at scale. The firm says this is not fully autonomous hacking, but it is a shift from AI as helper to AI as operator. Defenders should notice the ugly part: victims often learned AI was involved from attacker mistakes or provider monitoring, not their own controls.
NextGov/FCW’s account of Check Point’s research is worth reading with one hand on the brake. This is still vendor threat intelligence, and Check Point is not saying hackers have built fully autonomous intrusion machines. It is saying the boundary moved: over the past year, researchers saw AI generate commands, test vulnerabilities and help attackers move through victim networks, sometimes across thousands of commands with less human direction than researchers had previously seen.
That matters for government and critical infrastructure defenders because the claimed change is procedural, not cinematic. The attack chain did not acquire a new magic step. The old steps got cheaper: reconnaissance, exploit testing, internal tool-building, remote-control tooling and data theft. Check Point cited the Gentlemen ransomware group using mainstream models to build internal tools, and said a single developer produced roughly 88,000 lines of working VoidLink code in under a week using a commercial AI coding tool.
The awkward detail is detection. According to the report, AI’s role usually showed up because attackers made mistakes or because an AI provider monitored misuse. That is not a comforting control model for a federal agency or contractor trying to prove it can see what is happening inside its own environment. Monday’s work is not “buy AI defense.” It is instrument the boring layers: command logging, identity behavior, endpoint telemetry, egress monitoring and incident-response playbooks that assume attackers can now compress the parts of the intrusion that used to consume human time.
Published ·Deep Fathom