Why this matters now
Check Point Research described a scenario in which a DeepSeek model helped reconstruct working ransomware that runs entirely inside the browser, with no app installation, no exploit, and no native malware deployment on the victim system. For businesses, this is a strong signal that AI is reducing the skill barrier for attackers and compressing the time between a high-level idea and a practical attack chain.
In operational terms, this means security can no longer rely only on traditional antivirus and post-incident response. Companies now have to assume that attacks may abuse legitimate browser features, APIs, and user permissions instead of only exploiting known software vulnerabilities.
What the research showed
According to Check Point, the work started with analysis of a DeepSeek-attributed sample called InfernoGrabber, which contained incomplete or hallucinatory code but still pointed to a viable abuse path through the File System Access API in Chromium-based browsers. Researchers then showed that by reframing the prompt in more neutral language, the model could generate a working proof of concept that asks for access to local files and encrypts them inside the browser context.
A key detail is that the attack did not require an APK install, root access, or a browser exploit. The mechanism depended on a legitimate request for folder access and the permissions granted by the user.
How to protect a business from hackers
A practical defense program should start with five operational layers:
- Enforce MFA for email, admin panels, CRM, VPN, VPS, and cloud tools.
- Segment environments so websites, sales systems, databases, AI tools, and mailboxes do not sit in one flat trust zone.
- Centralize logs from servers, applications, reverse proxies, and privileged access points.
- Maintain offline backups and test restoration regularly.
- Train staff to recognize phishing, fake approval flows, and unusual file access requests.
This approach reduces blast radius, shortens detection time, and lowers dependence on any single defensive control. It matters even more when attackers use AI for rapid phishing generation, reconnaissance automation, and malicious workflow creation.
How to protect a website from AI attacks
Website owners and developers should review whether their systems expose high-risk browser APIs unnecessarily, including File System Access API, and whether users are given a clear business reason before any permission request is shown. Content Security Policy, restrictions on inline scripts, strong input validation, rate limiting, and WAF controls also matter because AI can increase the scale and mutation speed of automated attack attempts.
When AI components are embedded in a website or product, they should be isolated from critical systems and monitored at both input and output level. Minimal privileges for agents and services help contain the impact of prompt injection or function abuse before it spreads deeper into the environment.
Cybersecurity trends for 2026
The strongest trends are the rise of browser-native attacks, prompt injection, AI-assisted reconnaissance, and a lower barrier to entry for less sophisticated attackers. At the same time, behavioral monitoring, segmentation, and least-privilege design are becoming more important because signature-based defenses alone are increasingly insufficient against fast-generated attack variants.
For business leaders, this shifts cybersecurity from a narrow IT task to an operational design requirement. Security now has to be built into websites, automations, AI tools, and workflows from the start rather than added after an incident.
Recommendations for companies
The most practical action plan for now is:
- Turn on MFA everywhere possible.
- Separate website, CRM, email, automation, and AI environments.
- Audit which applications request access to files or folders.
- Deploy CSP, rate limiting, and a baseline WAF.
- Test backup recovery against a ransomware scenario.
- Train the team on new AI-enabled phishing and fraud patterns.
This is no longer a “later" project. The Check Point case shows that legitimate browser capabilities and AI-generated code can be combined into a practical attack faster than many organizations can complete a traditional security review.
FAQ
How can a business be protected from hackers?
The most important controls are MFA, environment segmentation, event logging, offline backups, and staff training. In 2026, organizations must also account for AI-assisted attacks that accelerate phishing, reconnaissance automation, and malicious code generation.
How can a website be protected from AI attacks?
Limit high-risk browser APIs, deploy CSP, validate inputs, apply rate limiting, and isolate AI modules from critical systems. Extra care is needed for any feature that asks users for access to local folders or files.
What are the most important cybersecurity trends?
Key trends include browser-only ransomware, prompt injection, AI-assisted phishing, and the broader abuse of legitimate platform features instead of traditional exploits.