Security researchers at Check Point Research (CPR) have warned that web-based AI assistants with browsing capabilities could be repurposed as covert command-and-control (C2) channels – the communication pathways attackers use to send instructions to compromised machines and receive stolen data.

In newly-published research titled AI in the Middle: Turning Web-Based AI Services into C2 Proxies & The Future of AI Driven Attacks, CPR details how certain AI assistants that support web browsing or URL fetching can be abused as command-and-control relays, effectively acting as “AI as a proxy”. This, the firm said, allows attacker traffic to blend into legitimate, commonly permitted enterprise communications.

The technique was demonstrated against platforms including Grok and Microsoft Copilot, using anonymous web access combined with browsing and summarisation prompts. According to CPR, the same mechanism could enable AI-assisted malware operations, such as generating reconnaissance workflows, scripting attacker actions and dynamically deciding “what to do next” during an intrusion.

AI tools are increasingly embedded in browsers, collaboration suites and developer environments, meaning their domains often form part of routine corporate traffic. CPR argues that threat actors are already exploiting this shift.

While AI is commonly used to accelerate malware development – for example by generating code or drafting phishing content – the researchers say the next step is more significant: integrating AI directly into malware runtime behaviour.

In what CPR describes as AI-Driven (AID) malware, an implant’s behaviour is shaped dynamically by model output rather than fixed decision trees. Malware can collect contextual information from an infected host – such as installed software, domain membership or geography – and use an AI model to help determine which actions to take, which data to prioritise and how aggressively to operate.

At the centre of the report is a proof-of-concept showing how AI assistants with web-fetch capabilities can be used as a bidirectional C2 channel. In the proposed scenario, malware sends a prompt to an AI web interface, instructing it to retrieve content from an attacker-controlled website. The response returned by the AI can then contain embedded commands.

To test feasibility, CPR set up a controlled HTTPS website and instructed the AI tools to fetch and summarise it. By embedding hidden content within the page, the researchers demonstrated that both Grok and Microsoft Copilot would retrieve and return planted commands. They noted that encoding or encrypting data was sufficient to bypass some safeguards designed to block clearly malicious content.

Recommended reading

• Report: 28% Global Cyber-attack Increase in Q1 2024
• Europe’s AI Security Controls Lag As Attack Surfaces Expand
• 92% of Enterprise Devices Unprepared for AI Security Challenges

The team also developed a C++ proof-of-concept using WebView2, an embedded browser component, to show how malware could automate the process without visible user interaction. The program gathered basic system information, appended it to a URL and instructed the AI assistant to fetch and summarise the page, effectively creating a covert communication loop.

Beyond the proxy technique, CPR outlined several potential future use cases for AI-Driven malware. These include using AI to assess whether a system is a sandbox before activating malicious behaviour, prioritising high-value victims at the command-and-control level, and selectively encrypting or exfiltrating high-value files to evade volume-based ransomware detection.

The researchers argue that this represents a service-abuse issue rather than a traditional software vulnerability.

CPR calls on AI providers to harden web-fetch features and improve enterprise visibility, while urging defenders to treat AI service domains as high-value egress points.