Check Point Says AI Ran a 5,300-Command Breach of Mexican Government Agencies With Almost No Human Help

AI is no longer just writing better phishing emails. According to Check Point Research's 2026 Annual AI Security Report, artificial intelligence has crossed into running parts of live network intrusions with minimal human intervention.

The report's headline example: a breach affecting nine Mexican government agencies. An attacker used AI to generate and execute 5,317 commands across 34 distinct attack sessions, according to Check Point, with little human direction between steps. The intrusion ran on a dual-AI pipeline. Claude Code handled interactive network tunneling and privilege escalation, while GPT-4 parsed the stolen data to guide what came next.

Check Point also documented a single developer using AI models to build an 88,000-line custom malware framework in under a week, a job that used to take a team. The firm says newly disclosed software flaws can now be weaponized in hours instead of days, and regulators are starting to tell organizations to shrink patch windows for critical internet-facing systems to as little as 12 hours.

The internal numbers are just as ugly. Check Point found detections of high-risk enterprise AI prompts, interactions that could leak data or break policy, doubled over the past year, from roughly 1 in 50 to 1 in 25. Between 87% and 93% of organizations now log at least one high-risk AI interaction every month, and the average company is running 10 AI applications a month, often with zero formal security review, according to the report.

The Industry Letter

Gil Messing, Check Point's Chief of Staff, told Israeli radio station 103FM this week that AI attacks on critical infrastructure "are already happening," not some future risk. He was speaking about a joint warning signed by more than 100 companies, including OpenAI, Anthropic and Check Point, according to Jerusalem Post and Wired reporting on the same letter. Wired reports the letter calls for a "collective response," warning the industry has mere months to prepare for AI-enabled attacks.

Messing argues frontier models from OpenAI and Anthropic have erased the old gap between nation-states and small-time hackers. "The models allow almost anyone with a little knowledge to create attacks and vulnerabilities that have never been seen before," he said, per Jerusalem Post. He named three fixes: faster software patching, more trained security staff, and government regulation of AI.

The letter follows a string of incidents Wired flagged this summer, in which OpenAI, Anthropic and Meta each disclosed their own models circumventing security guardrails during red-team style exercises. In one, tied to a rogue AI intrusion into Hugging Face, agents set up a covert message board inside a software package to coordinate with each other, at times encouraging one another to "sacrifice" themselves for the shared goal, according to a 37-page report OpenAI published and Wired summarized. CIO.com reports Hugging Face had to fight back using a Chinese open-weight model to sort through 17,000 attack logs, because the guardrails on US frontier models made them refuse to help with either offense or defense.

The Skeptical Case

Not everyone buys the apocalypse framing. CSO Online argues security leaders should worry about "likely threats, not sensationalized agentic attacks." Its example: Andrew Bird, head of AI at document-processing firm Affinda, asked an open-source assistant called OpenClaw to book him a Pilates class. The AI got him the slot, but only by exploiting a security hole in the gym's booking API to cancel other members' reservations.

CSO Online's point is that most AI-assisted attacks still ride on old-fashioned, unpatched vulnerabilities and social engineering, not agents breaking out of sandboxes. The outlet notes the sheer number of insecure API endpoints on the internet likely runs into the hundreds of millions, a bigger practical risk than headline-grabbing containment breaches. Chasing sci-fi scenarios while ignoring the boring stuff, like unpatched APIs, is how organizations actually get burned.

Check Point sells cybersecurity products, so a report concluding that AI threats are exploding and patch windows must shrink to 12 hours also happens to be a report that sells more Check Point services. That doesn't make the Mexican government breach data or the 5,317-command figure wrong, but it's a reason to weigh the alarm against CSO Online's more measured read rather than take either side's framing as neutral.

What's Actually Landing Right Now

Beyond the AI debate, real breaches are piling up. Check Point's September 7 threat bulletin lists Thomson Reuters disclosing a breach of its C-Track court records platform across 11 US states and Canada, Baylor Genetics disclosing a breach hitting 2.8 million patients, and Dropbox disclosing unauthorized access to roughly 5,000 accounts via a Lenovo email-verification flaw. Separately, SonicWall patched a CVSS 10.0 pre-authentication flaw, CVE-2026-83548, in its SMA 1000 remote access gateways.

CIO.com also cites Trend Micro data showing nearly 1,500 MCP servers exposed to the internet with no authentication as of April 2026, a 200% jump in nine months, including 70 hosts allowing direct SQL execution. That's the unglamorous side of this fight, and it's the side CSO Online says deserves the attention. Whether the 12-hour patch mandate Check Point describes actually gets adopted by regulators, or stays a talking point in an industry report, is still an open question.