The triple role of AI in cyberattacks (AI Threat Landscape)

Check Point Research’s new AI Threat Landscape report shows how quickly AI-related cyber threats are moving from theory to practice. Over the past two months, researchers have documented AI models operating beyond the environments they were designed for, cybercriminals using the first-ever AI-powered ransomware attacks, and threat actors creating illicit markets around accessing AI services and bypassing security controls.

These developments are part of a broader shift. AI is no longer just a tool in the hands of attackers. It is evolving into a target, an attack surface, and, increasingly, an active agent in cyber incidents. For organizations accelerating its adoption, the report shows that security strategies must evolve at a similar pace.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

AI security enters a new phase

AI models operate beyond their predicted limits

• In separate incidents involving the OpenAI, The anthropic and Meta, AI models gained access to production systems outside of the evaluation environments they were intended for.
• In one of the most significant cases, an OpenAI evaluation model reached the Hugging Face production infrastructure through a previously unknown vulnerability.
• The researchers then reconstructed the history of approximately 17.600 actions taken by the AI ​​agent that are linked to the incident.
• The findings have intensified the industry debate about AI autonomy, control, and governance as systems gain more capabilities and become connected to real-world environments.

Cybercriminals are integrating AI into their operations

• The criminal use of AI has moved from the experimental stage to practice, as threat actors increasingly incorporate AI tools into real-world attack operations.
• Researchers have recorded a ransomware incident with autonomous action via AI (agentic ransomware), in which an AI model executed stages of a blackmail campaign after being activated by a human operator.
• At the same time, ransomware group affiliates used AI-powered programming assistants to support attacks against at least six organizations.
• Developments show that the gap between the most advanced AI capabilities and their exploitation by cybercriminals is steadily narrowing.

A new illegal market is developing around access to AI

• Researchers identified a growing cybercrime market focused on accessing AI services and bypassing compliance checks and security controls.
• In one operation, attackers extracted nearly 3.000 API keys and AI account credentials from exposed files on more than 1.700 systems in just seven weeks.
• Criminal forums are increasingly focused on gaining permanent access to AI services and methods that consistently bypass security controls, rather than relying on isolated jailbreak techniques.

AI systems themselves are becoming targets of attacks

• AI programming agents, corporate copilots, and AI-based applications are increasingly being targeted by attackers.
• Researchers documented attacks on trusted AI workflows, including programming assistants and enterprise AI tools that use user content and code repositories as input.
• Supply chain breaches affecting AI frameworks and development tools impacted more than 2.500 companies, highlighting the expanding attack surface around AI ecosystems.
The everyday use of AI remains a significant source of risk
• Not all risks associated with AI come from sophisticated threat actors.
• The report found that one in 36 prompts submitted to productive AI services posed a high risk of exposing sensitive information.
• 88% of organizations recorded at least one high-risk interaction with AI during July.
• The findings highlight a growing governance challenge as AI adoption progresses faster than the ability of many organizations to implement data protection policies, controls, and safeguards.

AI as a new field of security

Several trends are converging: models are exceeding their predicted limits, attackers are orchestrating larger scale operations using AI, defenders are leveraging AI to identify vulnerabilities faster, and organizations are inadvertently exposing sensitive information through its everyday use.
For security leaders, the challenge now is to protect the entire AI ecosystem, which includes users, agents, applications, data, APIs, and infrastructure. The critical question for organizations is not whether AI will change cybersecurity, but whether security programs can adapt quickly enough to keep up with its pace.

As Sergey Shykevich, Director of Cyber ​​Threat Intelligence at Check Point Software, said: “The events of the past two months show that AI security has entered a new phase. Organizations and attackers are now using AI, which is simultaneously evolving into a target, an attack surface, and, in some cases, an active and almost autonomous agent of cyber incidents. As enterprises accelerate its adoption, security leaders need visibility not only into models, but also into the data, applications, and workflows connected to them. Building cyber resilience in the AI ​​era requires an approach that prioritizes prevention and protects users, applications, agents, and infrastructure in a combined manner.”

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.