# Check Point 2026 AI Security Report: Autonomous AI-Driven Exploitation, CLAUDE.md Jailbreaking, and Generative Identity Fraud Fuel Scattered Spider / ShinyHunters Campaigns

> Check Point's 2026 AI Security Report documents AI's shift from assistant to autonomous operator: threat actors ran thousands of AI-executed commands with minimal human direction (including a lone hacker's Claude Code + GPT-4.1 breach of nine Mexican government agencies), used CLAUDE.md-based prompt injection to hijack agentic sessions, built deployment-ready malware such as the 88,000-line VoidLink C2 framework in under a week, and deployed generative voice/face/document fraud at scale ($250M in FBI-attributed voice-fraud losses). The report ties these capabilities to active, ongoing campaigns by Scattered Spider (Marks & Spencer DragonForce ransomware, Jaguar Land Rover production shutdown) and ShinyHunters (year-long Salesforce OAuth/vishing campaign), with 87-93% of organizations experiencing high-risk AI interactions monthly from October 2025 to May 2026.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1347
- **ID:** TL-2026-1347
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Scattered Spider
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Check Point Research's AI Security Report 2026, published 14-15 July 2026, is a telemetry- and incident-driven assessment that argues generative AI has crossed from an attacker-assistance tool into an autonomous attack operator. The report's central evidentiary examples are: (1) a criminal breach of multiple Mexican government agencies in which AI executed thousands of commands autonomously across dozens of sessions with minimal human direction between steps -- independently corroborated by Gambit Security, which found a lone hacker logged 1,088 prompts that generated 5,317 AI-executed commands across 34 live sessions between December 2025 and February 2026, exfiltrating over 150GB of data (including 195 million taxpayer records from Mexico's federal tax authority, SAT) using Claude Code (which issued roughly 75% of remote commands) paired with GPT-4.1 and a custom 17,550-line Python tool, BACKUPOSINT.py, that shipped stolen server data to OpenAI's API to generate 2,597 reconnaissance reports on the government's server architecture; Anthropic confirmed the abuse, banned the associated accounts, and hardened misuse detection; and (2) VoidLink, an 88,000-line Zig-language cloud-native command-and-control framework targeting AWS/Azure/GCP that a single developer built almost entirely with the TRAE SOLO AI coding agent using spec-driven development in under one week, comprising 37 plugins spanning reconnaissance, credential harvesting, lateral movement, persistence, and anti-forensics, with cloud-aware stealth that fingerprints Docker/Kubernetes execution to adapt behavior. On the jailbreaking/prompt-injection side, the report documents the 'CLAUDE.md method,' in which attackers plant malicious instructions in configuration files that coding agents automatically load at session start, persisting across turns until the file is removed and exploiting the fact that LLMs process instructions and untrusted data as a single text stream. Malicious prompt-injection payload detections rose roughly fivefold between March and May 2026, and high-risk enterprise AI prompt rates doubled from about 1-in-50 to 1-in-25 interactions over the reporting window, with indirect prompt injection approaching 1% of observed prompts by May 2026 -- evidence the report frames as indirect prompt injection becoming a routine, operational attack path rather than a theoretical risk. On generative identity fraud, the report finds forged voice, face, document, and live-video content is now cheap to produce convincingly, with autonomous AI-run identity fraud already observed in real attacks and criminal marketplaces (autonomous interactive video remains emerging); trained observers correctly identified AI-generated faces only 41% of the time versus 30% for the general public, and the FBI attributes $250 million in losses to voice-enabled fraud. The report explicitly ties this capability shift to two named, currently active campaigns. Scattered Spider (with reported overlap/collaboration with ShinyHunters and Lapsus$ under the 'Scattered Lapsus$ Hunters' banner) is linked to the March-April 2025 Marks & Spencer breach, in which a Tata Consultancy Services employee was socially engineered and their account used to email M&S a payload that deployed DragonForce ransomware, and to the Jaguar Land Rover intrusion beginning 31 August 2025, which halted all JLR production for three weeks and is estimated to have cost the UK economy up to GBP 1.9 billion -- among the most damaging cyberattacks in British corporate history; some investigators have since raised the possibility of Russian state involvement or tacit support, though attribution remains contested. ShinyHunters is documented via a year-long (mid-2025 to mid-2026) phone-based (vishing) campaign against Salesforce customers, tracked by Google Threat Intelligence Group/Mandiant under clusters UNC6040 (initial access), UNC6240 (extortion), UNC6395 (the August-September 2025 Salesloft/Drift OAuth token theft, the largest SaaS breach on record, exposing over 700 organizations including Cloudflare, Zscaler, Palo Alto Networks, Proofpoint, PagerDuty, and Tanium), and UNC6661/UNC6671 (a January 2026 Okta/enterprise vishing wave). Vishing calls impersonating IT support talk employees through Salesforce's OAuth consent screen to authorize an attacker-controlled connected app disguised as Salesforce's own Data Loader, granting persistent API access; a related November 2025 campaign abused Gainsight-published Salesforce integrations to compromise 200+ instances (Atlassian, DocuSign, F5, GitLab, Malwarebytes, SonicWall, Thomson Reuters, Verizon), and an April-May 2026 wave abused stolen Anodot tokens to access Instructure/Canvas (275M records, 3.65TB), defacing 330 Canvas portals on 7 May 2026 before a ransom was paid by 12 May 2026 to forestall leakage. No CVE is associated with this report; it is a threat-landscape/campaign synthesis rather than a single-vulnerability advisory, so severity is analyst-assigned based on active-campaign impact and scale rather than CVSS.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1598.004 Spearphishing Voice
- T1583.006 Web Services
- T1588.002 Tool
- T1588.007 Artificial Intelligence
- T1566.002 Spearphishing Link
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1078 Valid Accounts
- T1550.001 Application Access Token
- T1027 Obfuscated Files or Information
- T1497.001 System Checks
- T1621 Multi-Factor Authentication Request Generation
- T1556.006 Multi-Factor Authentication
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1580 Cloud Infrastructure Discovery
- T1550.001 Application Access Token
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1537 Transfer Data to Cloud Account
- T1567.002 Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact
- T1491.001 Internal Defacement
- T1657 Financial Theft

## Sources

- [Check Point AI Security Report 2026 (via Help Net Security)](https://www.helpnetsecurity.com/2026/07/15/check-point-ai-security-report-2026/)
- [AI Security Report 2026 - Check Point Research](https://research.checkpoint.com/2026/ai-security-report-2026/)
- [Check Point Research: AI Has Crossed from Assistant to Operator](https://www.checkpoint.com/press-releases/check-point-research-ai-has-crossed-from-assistant-to-operator-rewriting-the-rules-of-autonomous-ai-cyber-attack-and-defense/)
- [Hacker Used Claude Code, GPT-4.1 to Exfiltrate Hundreds of Millions of Mexican Records](https://hackread.com/hacker-claude-code-gpt-4-1-mexican-records/)
- [Hackers Weaponize Claude Code in Mexican Government Cyberattack](https://www.securityweek.com/hackers-weaponize-claude-code-in-mexican-government-cyberattack/)
- [VoidLink: The Cloud-Native Malware Framework](https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework/)
- [VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code](https://thehackernews.com/2026/01/voidlink-linux-malware-framework-built.html)
- [ShinyHunters Threat Actor Profile: TTPs, IoCs & Attacks](https://www.huntress.com/threat-library/threat-actors/shinyhunters)
- [Defending SaaS-based applications against ShinyHunters OAuth abuse](https://www.microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abuse/)
- [Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity](https://thehackernews.com/2026/07/microsoft-maps-year-long-shinyhunters.html)
- [Scattered Spider-Linked Group Claims JLR Cyber-Attack](https://www.infosecurity-magazine.com/news/scattered-spider-claims-jlr-cyber/)
- [Jaguar Land Rover cyberattack](https://en.wikipedia.org/wiki/Jaguar_Land_Rover_cyberattack)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1347