Companies are wiring language models and autonomous agents into core processes, and it makes them faster. It also creates entry points that did not exist before. Two stand out: freely downloadable skills whose origin nobody checked, and compromised credentials. The pattern is familiar. It looks a lot like the cloud migration of recent years, when workloads moved into public environments before anyone had a security concept for them.
Skills off the internet, provenance unknown
Agents are extended through skills and add-ons. A large share of those building blocks comes from open sources and gets loaded without review. Origin and behaviour are rarely documented, so hidden functionality only shows up in production, if it shows up at all.
Thomas Boele, Global Director Solutions Engineering for AI Security at Check Point, puts it bluntly: users add skills that are simply there for the taking, with no idea what they are bringing in. A substantial share of them, he says, is malicious or carries a backdoor.
There is evidence behind that. The Shai Hulud 2.0 campaign compromised more than 600 npm packages and roughly 25,000 GitHub repositories, exposing thousands of developer credentials including cloud keys and GitHub tokens. Comparable risks arrive through the Model Context Protocol (MCP), which connects agents to external tools and data sources. Tampered MCP servers and poisoned RAG pipelines inject malicious logic, or a quiet data leak, straight into the agent's workflow.
Then there are agents that simply run off the rails. One with access to payment functions will, when something goes wrong, send transactions to the wrong place. Without defined boundaries the damage happens immediately, no attacker required.
The other classic: stolen credentials
Alongside skills, stolen credentials remain the most common way in. Infostealers harvest passwords and valid session tokens from infected machines, including personal devices that happen to have access to company services.
A valid token from Microsoft Entra ID holds an authenticated session open for a limited time, which effectively puts it in place of the second factor. If the affected account carries elevated rights, the reach extends into Active Directory. A find at the perimeter turns into a route inward.
Daniel Dreier, AVP Exposure Management at Check Point, stresses one simple check: what matters is not that a credential leaked, but whether it is still valid and whether it lets someone bypass multi-factor authentication via a session token. The vendor's DACH report records a 124 percent rise in attacks for 2025, attributes more than 80 percent of regional incidents to Germany, and names compromised credentials as the central starting point for ransomware.
A CVSS score says little about your risk
A generic CVSS value describes a vulnerability detached from your environment. Whether it can actually be exploited depends on context. An upstream firewall or a web application firewall stops some attacks before they land. Equally, a medium-severity flaw can be the most dangerous one in your particular setup.
Contextual validation therefore actively tests whether an attack works under the conditions you actually have, replaying shifting attack patterns to find out. According to the vendor, the catalogue of such test scenarios now covers around 5,500 cases. The principle amounts to continuous red teaming rather than a snapshot in an annual report.
Guardrails instead of bans
The same logic applies to AI applications before go-live. Models and agents get tested for attack paths including prompt injection, jailbreaks and model manipulation. Doing that once is not enough, because new techniques keep arriving.
Fred Streefland, EMEA CISO at Check Point, reaches for a traffic analogy: brakes do not make a car slower, they are what makes speed possible in the first place. Translated, binding limits do not hold employees back. They make productive use possible without anyone triggering actions outside the approved scope.
Part of that is framing how language models get used internally. Approved services rather than whatever tool someone found, policies for acceptable inputs and outputs, and a central view of what is actually in use. Shadow AI loses room to spread, without banning teams from experimenting altogether.
Runtime protection, and a layer that grades the model
At runtime, inputs, outputs and the entire data flow are monitored, including content from RAG pipelines and connections through MCP servers. That is exactly where manipulated skills reveal themselves, because you cannot read their behaviour beforehand. Latency matters here: protection that visibly slows the business down gets switched off sooner or later.
Above that sits an evaluation layer. Language models return different answers to the same question, so predictability needs a control instance. This layer checks for hallucinations, hidden bias and unwanted behaviour before agents act autonomously and reach into other systems.
Humans stay in the loop
Detecting is not fixing. From ticket creation to remediation, 60 days and more is common, and rebooting a business-critical system during operating hours is often simply off the table. What remains workable are measures that demonstrably break nothing, such as flipping a protection feature from "detect" to "prevent", tuning IDS and IPS, or setting registry keys. Where "prevent" is risky because a service is live, "detect" comes first.
Agent autonomy is graded, running from observing through orienting and deciding to acting. Humans set the policies and the desired outcome. Agents act without prior approval only in time-critical situations, such as a globally distributed threat where asking first would cost too much time. Otherwise someone in the security operations centre looks at it.
What to take away
These recommendations come from a vendor that sells the matching products. The core still holds, product names aside. Review what skills and MCP servers you load into your agents, the same way you would not blindly install every npm package. Treat session tokens as what they are, a stand-in for the second factor. And give agents with access to money, customer data or production systems clear boundaries before you let them run. Retrofitting security costs more and stays patchy, because fundamental architecture decisions are hard to reverse.