Check Point Detects Autonomous AI Agents Targeting Government Websites

Check Point stated in its intelligence report released on October 5 that autonomous AI agents used simple hacking techniques against US and Canadian government websites, including failed SQL injection attempts against the US Department of Education and Library and Archives Canada.

No successful breach was recorded, according to the report, nor was the origin of the agents identified, meaning the entity responsible for these attempts remains unknown so far, and the report documents the attempts without attributing them to a specific state or group. The lack of attribution indicates that the tools used are widely available and do not require massive resources.

The report also covered the "ClickFix" campaign, which used malicious custom GPT models to deliver malware providing remote access to systems, as well as an AI-powered threat actor that used stolen service accounts on the Azure platform for automated cloud reconnaissance and data destruction.

The report pointed to a critical vulnerability in the GitLab AI Gateway carrying the code CVE-2026-90970 with a severity score of 9.9 out of 10, a rating classified among critical vulnerabilities requiring urgent remediation. The report notes that executing these attempts via autonomous agents reduces the need for direct human intervention at every step.

What do these terms mean?

SQL Injection: A hacking technique that inserts code commands into a database via an unprotected input field. Autonomous Agent: An AI program that executes steps on its own without human intervention. CVSS Score: A scale from 0 to 10 that measures the severity of a security vulnerability. Malware: Software designed to cause damage or steal data.