AI Has Now Entered the Live Cyberattack Chain
Security researchers say artificial intelligence is moving beyond assisting hackers and is increasingly taking an active role in real-world cyberattacks.
Artificial intelligence is entering a new phase in cybersecurity, with researchers reporting that AI is no longer being used only as a tool to help attackers prepare operations. According to Check Point Research, AI systems are increasingly becoming active components of cyberattacks, helping perform tasks across reconnaissance, vulnerability research, malware development and intrusion activity.
The change is significant because AI can dramatically increase the speed at which cyber operations are carried out. Researchers have documented cases in which AI agents performed large numbers of actions across multiple sessions with limited human direction. This means attackers may be able to coordinate complicated operations faster than they could using traditional methods, potentially lowering the technical barrier for less-skilled criminals.
Another concern is that attackers are increasingly using mainstream AI services rather than relying exclusively on specialized underground tools. Researchers have identified attempts to bypass AI safety protections and cases involving stolen credentials used to access commercial AI services. Check Point also highlighted the growing threat of LLMjacking, where stolen credentials are used to access AI systems without authorization.
The development creates a difficult situation for cybersecurity teams because AI is now involved on both sides of the conflict. Organizations are deploying AI to detect threats, analyze security signals and respond more quickly, while attackers are simultaneously using AI to improve their own operations. Microsoft, for example, has described its Project Perception as an agentic security system designed to use AI to defend against AI-driven threats while keeping humans in control.
The emergence of AI inside live cyberattacks suggests that cybersecurity is entering an increasingly automated era. The biggest challenge will be ensuring that defensive systems can detect and contain AI-assisted threats before they cause significant damage. As AI agents become more capable of operating independently, organizations will need stronger monitoring, access controls and human oversight to prevent both attackers and legitimate AI systems from taking actions beyond their intended boundaries.
