Check Point Research published its AI Security Report 2026 on 13 July, and the headline finding is blunt: AI has “crossed from assistant to operator” inside real attacks. The proof point is a documented breach of nine Mexican government agencies by a single operator running Claude Code for network intrusion and exploration alongside GPT-4.1 for analysing stolen data — 5,317 AI-executed commands across 34 sessions, with minimal human direction between steps. The same report finds detections of lengthy prompt-injection payloads rose roughly fivefold between March and May 2026, and that “high-risk” enterprise AI prompts have doubled year over year, from around 1 in 50 interactions to 1 in 25.
There’s also a new persistence mechanism worth flagging separately from what we’ve covered before. Attackers are planting jailbreak instructions inside files like CLAUDE.md — the config file Claude Code loads automatically at the start of every session — so the instruction stays live until someone manually removes the file. That’s a different mechanism to the README-based social engineering behind the “Friendly Fire” exploit or the symlink trust-boundary gap behind “GhostApproval,” both covered here in July: those tricked an agent into misusing legitimate access in the moment, where a poisoned CLAUDE.md is a standing instruction that persists silently across every future session until it’s caught.
So what
This isn’t a reason to stop using AI coding agents — it’s a reason to ask sharper questions of whoever’s using them on your behalf. The same tools driving faster delivery are, per Check Point’s own data, now capable of running a multi-stage attack chain with almost no human oversight. If you’re commissioning software — especially anything touching customer data, payments, or (for us specifically) healthcare records — it’s worth asking your development partner directly: do they review config files like CLAUDE.md for planted instructions, isolate agent sessions, and scope AI tool permissions the way they’d scope any other privileged access? That’s exactly the discipline we build into AI-assisted engagements. See our AI-assisted development page for how we handle it, or get in touch if you want a second opinion on your current stack’s exposure.