AI is being used across several stages of the attack chain, including social engineering, malware development, vulnerability research, and support during live intrusions. Check Point Research describes incidents where AI handled exploitation workflows with minimal human direction, generating thousands of commands across dozens of sessions. In practice, AI can help attackers complete familiar tasks faster and with less expertise.

AI adoption can create security exposure when tools are used without formal oversight. The report says high-risk GenAI prompts doubled over the past year, while the average organization now uses 10 AI applications per month, many outside an approval process. Organizations can reduce blind spots by identifying the AI tools in use and reviewing how employees handle sensitive information in prompts.

The report identifies three routes: misusing commercial AI tools, running self-hosted open-source models, and buying access to purpose-built malicious services. Misuse of commercial tools is the most common in practice; attackers may also use stolen credentials. One campaign, Bissa Scanner, collected AI login details from more than 30,000 exposed configuration files. Self-hosted models and criminal-only services have had practical limitations, including weaker performance or poor quality.