Check Point finds 1,608 live ARTEX panels, and says one operator switched to more permissive Chinese models when Anthropic's Opus 5.5 hit guardrails
Check Point Research found 2,557 systems hosting or having hosted ARTEX panels, 1,608 of them live; exposed databases showed operators setting goals with little further prompting, mostly on Chinese models led by the DeepSeek Flash family, in campaigns that took more than 300 Apple code-signing certificates and more than 190,000 game-account credentials. It saw guardrails hit only on Anthropic's Opus 5.5, after which the actor moved to more permissive Chinese models.
Check Point's chief executive tells analysts "what we are seeing is a vulnerability apocalypse"
On Check Point's third-quarter earnings call, chief executive Nadav Zafrir said "what we are seeing is a vulnerability apocalypse" and that staying in reactive mode would lose, said phishing is now written by AI and attackers can hide instructions in it aimed at the AI assistants that read it, and cited the PHP2Shell vulnerability as a case where the company says its customers were protected before they needed to act.
Check Point says a campaign pairs genuine signed ChatGPT and Claude installers with a malicious DLL to drop a miner
CSO Online reports Check Point Research's account of Yoba, which uses fake GitHub repositories and websites boosted by SEO poisoning to deliver archives in which "a genuine signed Setup.exe from OpenAI or Anthropic is placed alongside a malicious file named winmm.dll", loaded by the executable; the observed final payload is the XMRig cryptocurrency miner. An earlier variant observed in June used a fake Cursor coding-agent application.
A payload wrapped in ordinary prose passed four guardrail models and was acted on by the model behind them
Check Point Research describes PuzzleMask, which embeds a policy-violating payload inside fluent, properly punctuated prose rather than an encoding scheme. The four tested gatekeepers — gpt-4o-mini, gpt-oss-safeguard, claude-3-haiku and llama-guard3 — all flagged the same payloads written plainly, but once wrapped “all four classifiers missed every single crafted prompt, a 100 percent bypass rate across the full test set”; the target model, GPT-5-thinking with high reasoning effort and code interpreter enabled, “recovered and acted on the hidden payload in 17 of 18 trials, about 94 percent,” each success requiring over a minute of reasoning and multiple executed scripts. Anthropic's Opus-class models were “the one consistent exception, shutting the interaction down every time.”
A shared internal package service let one ChatGPT account quietly task another account's session
Check Point Research reports that ChatGPT's code-execution containers all reached one internal JFrog Artifactory instance, and that item properties written from one account's container were readable from a different account's container moments later — a covert cross-account channel. Using it, “a crafted instruction could make a victim's ChatGPT session quietly process a second stream of tasks alongside the conversation the victim could actually see” and return the results, reaching whatever the victim's connected services allowed; the demonstration retrieved the victim's email data through a connected Gmail account. Check Point says OpenAI confirmed the internal Artifactory instance involved has been decommissioned.