Cyber attacks soar as
GenAI opens a gap

Never mind artificial intelligence wiping out humanity. Before it gets around to extinction, it is coming for the systems meant to protect your business.

New research from cyber security company Check Point Software shows the threat taking two forms. Organisations faced an average of 2,422 cyberattacks a week during August 2026, 22% more than a year earlier. At the same time, employees continued to feed potentially sensitive company data into generative AI tools.

Ransomware attacks almost doubled from August 2025, reaching 1,042 reported victims during the month. Phishing increased from one in every 128 emails in July to one in 112 in August. Links appeared in 72% of those phishing messages, usually directing recipients to sites created to steal credentials or deliver malicious software.

The GenAI threat often begins with an employee trying to get work done faster. Check Point found that one in every 43 prompts sent from enterprise networks posed a risk of data exposure. The rate fell to its lowest level in several months, but the number of prompts continued to grow. The average user generated 106 prompts in August, up from 95 in July and 78 in June.

A smaller proportion of risky prompts can still produce a growing volume of exposed information as overall use climbs. Among organisations using GenAI regularly, 86% were affected by high-risk prompt activity. Organisations used an average of seven different AI tools, leaving security teams to track which services received company information and what happened to it afterwards.

In practice, the leak may begin with an entirely ordinary request. An employee may ask a chatbot to summarise a confidential report or draft a response to a legal dispute. The tool needs the source material to complete the job. Once it has been pasted or uploaded, the company may have lost control over where it is processed, stored or retained.This is especially the case where free versions of GenAI platforms are being used.

Healthcare and medical organisations recorded the highest exposure rate for high-risk prompts, at 4%. Software companies followed at 3.6%, with business services at 3.5%. These are fields rich in patient records and client information. As a result, a useful AI request can become a data breach when staff treat a public chatbot as though it were an approved internal system.

The findings give a more immediate meaning to the warnings coming from researchers at Anthropic, developer of the Claude AI platform. Jacob Coxon, a former researcher at Anthropic and OpenAI, resigned from Anthropic this month after accusing the leading AI laboratories of racing towards self-improving superintelligence and “gambling with our lives”.

His concern was supported by Evan Hubinger, Anthropic’s alignment science lead, who put the chance of AI causing human extinction within the next decade at above 10%. Alignment researchers work on keeping advanced AI systems under human control and directed towards human goals.

Hearing such warnings from that coalface calls for serious scrutiny, although being too close to the system can also narrow the view. Researchers immersed in what future systems may become can give too little weight to the limits, institutions and human responses beyond the laboratory. One could argue, then, that extinction remains a speculative scenario. However, Check Point is measuring damage and risk inside organisations now.

“August’s data shows cyber risk expanding across several fronts at once,” says Lorna Hardie, regional director for Africa at Check Point Software. “With attacks climbing, ransomware accelerating, phishing remaining a common entry point and GenAI creating a new route for data exposure, security teams cannot rely on fragmented defences.

“They need a prevention-first protection approach that combines visibility, control and automation across network, cloud, endpoint, email and AI usage to stop threats before they disrupt operations or expose sensitive information.”

AI is creating problems inside and outside the corporate network. Criminals can use it to produce convincing phishing messages and adapt scams quickly. Employees can carry protected information past security controls simply by pasting it into a prompt.

The African figures add a regional urgency. Organisations across the continent experienced an average of 3,335 attacks a week, well above the global average of 2,422. Angola recorded 5,416 attacks per organisation per week, Nigeria 4,906 and Kenya 3,658.

South Africa came in below the global average at 2,086 attacks per organisation per week, down 3% year on year. That still works out at almost 300 attacks a day for the average organisation covered by the research.

Energy and utilities were the most targeted sector in Africa, followed by financial services and government institutions. An attack on any of these can spread its impact far beyond the organisation breached, through interrupted electricity, payments or public services.

Education remained the most attacked sector worldwide, experiencing 5,354 attacks per organisation each week, an increase of 28% over the year. Government followed at 3,067. Hospitality, travel and recreation moved into third place with 3,056, up 56%.

Business services accounted for 36% of reported ransomware attacks, followed by industrial manufacturing at 13% and consumer goods and services at 12%. Business-services companies often connect directly to the systems of numerous clients and suppliers, giving attackers a route towards further victims.

The ransomware groups also changed position during August. Qilin was responsible for 15% of published attacks, followed by The Gentlemen at 10%. Orova entered the three most active groups for the first time. The names may sound like characters rejected from a low-budget action movie, but the 1,042 victims represent companies whose operations and data became criminal bargaining chips.

The biggest problem is that older cyber defences were built mainly to stop hostile outsiders. So while a firewall can block a malicious connection or prevent an employee opening a known phishing site, it has a much harder job recognising that an authorised employee has just pasted next year’s product plan into an authorised AI service.

* Arthur Goldstuck is CEO of World Wide Worx, editor-in-chief of Gadget.co.za, and author of The Hitchhiker’s Guide to AI – The African Edge.