Two days ago, Check Point Research published its annual AI Security Report. It's the kind of report that gets cited in headlines and then forgotten. We don't think you should forget this one.
The headline finding: AI has stopped being a tool that helps attackers think. It's become the attacker.
What actually happened
The report documents a real intrusion — not a simulation. A single operator breached nine Mexican government agencies using two commercial AI tools running in tandem. One handled initial access and network exploration, the other analyzed stolen data and planned follow-on activity. Together they generated 5,317 executed commands across 34 attack sessions. The human operator gave direction at the start, and the AI ran.
That's not a script. That's not a macro. That's an AI agent doing the work of a trained red team — target identification, credential harvesting, lateral movement, data staging — with one person at the keyboard issuing high-level instructions rather than writing exploit code.
The thing that changes the equation isn't sophistication. AI attacks have been "theoretically possible" for years. What's changed is that it happened, was documented with specifics, and the barrier to doing it again is now a free API account.
The 12-hour problem
AI can now take a freshly published vulnerability and turn it into a working exploit in hours. Not days. Not weeks.
This has pushed government authorities in multiple countries to shorten mandated remediation timelines to as little as 12 hours for the most critical internet-facing systems.
Think about what 12 hours means operationally. A CVE drops Monday morning. By Monday afternoon, working exploits exist. By Tuesday morning, you're supposed to be patched.
Most 15-50 person orgs have a single person handling IT, or a part-time MSP with a weekly check-in. The workflow of "notice CVE, evaluate severity, test patch on staging, deploy to prod" doesn't happen in 12 hours unless you've built the infrastructure to move that fast. Very few small orgs have.
This matters even more now because CISA's Known Exploited Vulnerabilities catalog has become an active target list. An attacker scanning for unpatched systems doesn't need to find novel vulnerabilities — they just need to find orgs that are still running software with a known CVE that dropped three days ago. And increasingly, the thing doing that scan is an AI agent running overnight.
Your AI tools are the attack surface now
Bury the lead elsewhere. Here's the one people are going to miss.
Detections of large malicious prompt-injection payloads rose roughly fivefold between March and May 2026. That's not a gradual trend — that's an acceleration.
Indirect prompt injection is the attack pattern where malicious instructions are hidden inside content that your AI reads as part of its normal job. A vendor invoice that tells your AI bookkeeping assistant to forward your banking details to an external address. A job application that tells your AI screening tool to rank the applicant first. A document your AI summarization tool processes — with hidden text instructing it to exfiltrate data from other documents it has access to.
This was a theoretical attack class in 2024. By May 2026, it was a routine attack path.
The average organization now uses 10 different AI applications per month, many without formal approval. Each of those apps processes external content. Each is now a potential injection point. And between 87% and 93% of organizations experienced at least one high-risk AI interaction in every month of the past year.
That number isn't just a stat about big enterprises. It's your team too.
What this means if you're a 20-person org
The Check Point findings aren't pointing at scenarios that require you to be a high-value target. They're pointing at scenarios that require only that:
- You're using AI tools connected to sensitive data (everyone is)
- You haven't patched something critical recently (most orgs haven't)
- An attacker finds you via automated scanning (that scan costs almost nothing now)
The autonomy shift removes the human cost constraint that used to protect small orgs. Running a sophisticated multi-stage intrusion used to require skilled operators spending real hours. That time cost made smaller targets not worth it. When the attack is running largely on autopilot, the economics shift. Small targets become worth scanning.
The injection finding hits closer to home: every AI tool you use to handle external content — emails, documents, web data, customer inputs — is now being probed for this. Most small orgs haven't audited what their AI tools can access if they get manipulated.
What to do this week
Get on real-time CVE feeds. CISA KEV has an RSS feed. Your team should see new exploited vulnerabilities the same day they're published, not Friday when someone checks their inbox. Set up a Slack or Teams notification for CISA KEV additions. This is a one-afternoon setup with significant impact.
Map what your AI tools can touch. For every AI application in your stack — document AI, email AI, scheduling AI, whatever — write down what data it has access to and what actions it can take. Most teams, when they actually do this, find at least one tool that has more access than it should. Scope it down.
Treat prompt injection like SQL injection. If your org built any custom AI workflows that process user-submitted content or external data, that content needs validation. Never let AI-processed external content directly trigger sensitive actions without a human checkpoint or an allow-list of permitted outputs.
Automate your patching pipeline for critical systems. If you're using cloud providers, turn on auto-patching for OS updates on internet-facing infrastructure. For software you manage manually, set up monitoring that alerts on CVE disclosures for your stack. The 12-hour window isn't achievable manually — you need automation.
The report is free to read. Worth the hour.
This is the kind of audit we run with small orgs: what's your AI surface area, what's it connected to, and what does an attacker do with it if they get in through any one of those doors. Usually surfaces a few quick wins. Sometimes surfaces something that needs fixing fast. Either way, you come out knowing what you're actually defending.