Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
Check Point Research demonstrated an "AI in the Middle" attack in which malware can abuse web-based AI assistants with anonymous or unauthenticated browsing and URL-fetch capabilities as a covert command-and-control channel. The proof of concept used public AI web interfaces, including Grok and Microsoft Copilot, to cause the AI service to fetch attacker-controlled URLs, relay victim data in outbound requests, and return attacker-supplied commands through normal AI assistant responses.
Because the implant communicated with trusted AI service domains over ordinary HTTPS web traffic, the activity could blend into expected enterprise AI usage and evade controls focused on suspicious infrastructure, unusual protocols, API keys, service accounts, or revocable credentials. The lack of required authentication for some web-fetch workflows also made it harder for defenders to disable the channel by rotating API keys, suspending accounts, or revoking tokens. The researchers recommended stronger authentication and access controls for AI web-fetch features, along with improved visibility into AI-initiated network requests and AI assistant interactions.
Why this record has no ERS
The compromised asset is a conventional endpoint running custom malware; the web AI assistants serve only as an unwitting relay channel and no control outcome of the assistant providers is reported. The attacker's implant is out of scope, so the record fails the system and observation tests of the scorability admission test. It is retained as threat context for assessments of AI services that offer anonymous URL fetching.
Status: Not scorable by design · Classification: Validated Research · source date 2026-08-06 · primary evidence date 2026-02-17
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0061 (exercise) |
|---|---|
| Target | Enterprise machines with Grok and Microsoft Copilot access |
| Actor | Check Point Research |
| Primary evidence date | 2026-02-17 |
| SecureFlow record updated | 2026-08-06 |
| AI layers | AI infrastructure |
| Risk impact | Resource hijacking / cost, System compromise / RCE |
| Affected components | Grok and Microsoft Copilot web interfaces, anonymous or unauthenticated URL fetch workflow, custom C++ implant with embedded browser or WebView, attacker-controlled HTTPS relay domain, enterprise endpoint and proxy telemetry |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Survey Anonymous AI Web Fetch ServicesThe researchers evaluated public AI assistants with anonymous or unauthenticated web-browsing and URL-fetch behavior to identify services that could retrieve arbitrary adversary-controlled URLs without requiring API credentials. The researchers found Grok and Copilot met those conditions. | AML.TA0002 AML.T0095 |
| 2 | Register Relay DomainThe researchers registered a domain and deployed an HTTPS site to act as the relay endpoint. | AML.TA0003 AML.T0008.002 |
| 3 | Host C2 Relay ContentThe researchers hosted benign-looking content while also returning data that the implant could treat as C2 instructions. | AML.TA0003 AML.T0079 |
| 4 | Launch WebView-Based Implant SessionAssuming prior access, the researchers used a custom C++ implant with an embedded browser or WebView component to interact with Grok or Microsoft Copilot through the public web interface rather than an API key. | AML.TA0000 AML.T0047 |
| 5 | Prompt AI Service to Fetch Relay URLThe researchers crafted prompts that instruct an AI service to fetch and summarize a website. The prompts caused victim data to be included in URL parameters, allowing the AI service's fetch request to relay data to the adversary-controlled server. | AML.TA0003 AML.T0065 |
| 6 | Obfuscate Relay PayloadsWhen some prompts were blocked by model safeguards, the researchers encoded or encrypted payload data into high-entropy blobs to reduce the chance that safeguards would identify the content as malicious. | AML.TA0007 AML.T0068 |
| 7 | Collect Host Information LocallyThe implant collected basic host information from the local system. The researchers noted that this could be expanded to collect details such as username, domain, computer name, installed software, running processes, and startup programs. | AML.TA0009 AML.T0037 |
| 8 | Relay Through AI Service Web InterfaceThe implant initiated an anonymous web-based session with the public AI service and sent the crafted prompt. This formed a command-and-control channel whereby data was exfiltrated via requests to the adversary-controlled domain, and commands were communicated back via the response. | AML.TA0014 AML.T0114 |
| 9 | Exfiltrate Host Data via AI FetchThe victim's collected host information was exfiltrated when the AI service followed the instructions to fetch the URL to the adversary-controlled domain with the data embedded in a query parameter. | AML.TA0010 AML.T0086 |
| 10 | Execute Commands from AI ResponseThe AI service summarized the response from the adversary-controlled site, and the implant executed the extracted commands. In the proof of concept, the command launched Calculator using `cmd.exe /c calc.exe`; a real implant could execute other commands, download payloads, sleep, or collect additional data. | AML.TA0005 AML.T0050 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0061-ai-in-the-middle-web-ai-services-c2-relays; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0061 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-M-001.004 | AI Service & Embedded SaaS AI DiscoveryExact SecureFlow defense-map identifier (flow atlas-aml-cs0061-ai-in-the-middle-web-ai-services-c2-relays), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Fa-3 Tr-4 Cn-5 |
| AID-I-002.002 | Secure External AI Service ConnectivityExact SecureFlow defense-map identifier (flow atlas-aml-cs0061-ai-in-the-middle-web-ai-services-c2-relays), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-4, step-8. Presence supplies no score credit. | Candidate evidence route | Cn-4 |
| AID-D-005.009 | AI-Service C2 & Abuse-Channel DetectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0061-ai-in-the-middle-web-ai-services-c2-relays), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-4, step-6, step-8, step-9, step-10. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-I-003.002 | Identity, Session & API Rate-Limit ThrottlingExact SecureFlow defense-map identifier (flow atlas-aml-cs0061-ai-in-the-middle-web-ai-services-c2-relays), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 Cn-7 |
| AID-H-018.005 | Value-Level Capability Metadata & Data Flow Sink EnforcementExact SecureFlow defense-map identifier (flow atlas-aml-cs0061-ai-in-the-middle-web-ai-services-c2-relays), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |