Area Manager

Stopping the AI agent actions no rule could See coming. By Check Point Team Check Point introduces a new class of contextual AI protection that understands an agent's full context, intent and behavior across multiple steps, and prevents harmful actions before they execute. AI agents are already operating inside the enterprise. Coding agents write and execute code, interact with repositories, access cloud infrastructure and invoke tools. Workforce agents process documents and messages, retrieve enterprise data and complete business workflows. As these systems act with greater autonomy, security has to look beyond malicious prompts and individual payloads to the outcomes an agent's actions can create. Harmful behavior does not always begin with something recognizably malicious. It can emerge naturally from a sequence of otherwise legitimate actions, where the risk becomes visible only in context. Check Point's approach brings the full context of the agent's activity into the security decision. The protection continuously evaluates the full course of an agent's activity, including the original user intent, the information the agent has encountered, the actions it has already taken, the policies that apply and the action it is about to execute. It connects those signals in real time and prevents actions that are harmful, unauthorized or inconsistent with the intended task. This matters because agentic risk often does not appear in a single prompt, response or tool call. It emerges from context. See it in action Watch contextual AI protection stop a harmful agent action See how Check Point AI Security evaluates an agent's full context, user intent, prior actions and policy, and prevents the actions that do not belong, before they execute. Book a session with its team and bring your own agent use cases. Seeing what isolated guardrails cannot. Most AI security controls are designed to recognize a specific type of risk. One may detect prompt injection. Another may identify sensitive data. Another may flag off-task behavior. These controls remain important, but they depend on knowing what to look for. Check Point's contextual protection adds a fundamentally different capability: it can recognize harmful agent behavior without requiring a predefined rule or signature for that specific behavior. By understanding the task and the agent's activity as a whole, it can identify when an otherwise legitimate action creates a harmful outcome in context. Consider a coding agent working with production systems. It accesses production logs as part of a legitimate task. Later, it stores information from those logs in a working variable. Then it attempts to use that variable while creating a ticket in a public-facing system. Each step can appear reasonable in isolation. Together, they create a data leak. Check Point's contextual protection understands the relationship between those actions and blocks the final step before the sensitive information leaves its intended environment. The risk was not hidden inside one action. It was spread across the sequence. Understanding intent, not just instructions. The same contextual understanding allows Check Point to identify when an agent's behavior begins to diverge from what the user actually asked it to do. In one real-world case, an autonomous coding agent operating in auto mode attempted to upload files directly to an S3 bucket. The user had not requested the upload, and the expected development process required the files to move through GitLab. Uploading a file to S3 is not inherently dangerous. In another workflow, it could be exactly the right action. Here, it was not. Without relying on a predefined rule or signature for this specific behavior, the protection understood the broader context of the task, recognized that the action did not fit the user's intent, and prevented the upload before it occurred. This was not a scripted attack scenario. It was genuine unexpected behavior from an autonomous coding agent during real use. That distinction captures one of the most important challenges in agent security. Agents do not simply execute predefined commands. They reason about how to complete objectives, choose tools and determine intermediate steps. That flexibility is what makes them powerful, particularly in development environments, but it also creates room for actions that were never explicitly requested and may fall outside the expected process. A technically valid action can still be the wrong action. "Agents are useful because they find approaches we did not anticipate. With a ruleset, protection is limited to what we anticipated when we wrote the rules. A security model that evaluates the full task checks each action against what the user asked for and prevents the ones that do not fit. That is what customers are asking us for, and why this capability matters now." - Ofir Israel, VP AI Security R&D, Check Point Preventing harmful agent actions. Contextual understanding also adds another layer of defense against indirect prompt injection. A user may ask an agent to summarize an email, document, webpage or message. Hidden inside that content is an instruction planted by an attacker telling the agent to retrieve credentials, export information or perform some other unauthorized action. The agent sees both the legitimate content and the attacker's instructions. Check Point sees the larger context. The user asked for a summary. The resulting attempt to retrieve credentials or send information elsewhere does not belong to that task. The protection recognizes the mismatch and prevents the action. Rather than relying only on detecting the malicious instruction itself, the protection can also recognize the harmful action it attempts to trigger. The same approach applies when the source of the risk is not malicious. An agent may attempt a destructive command that has no reasonable connection to its task. It may try to grant itself broader permissions without the required approval. It may attempt to send confidential information to a destination that conflicts with enterprise policy, even when the original instruction came from a legitimate user. These situations are different in cause, but similar in the way they appear at the point of action. The individual command may be valid. The tool may be approved. The user may be legitimate. The context reveals whether the action belongs. From individual signals to the full agent story. The innovation lies in bringing those signals together continuously. Check Point evaluates the agent's activity across the flow of work and maintains the context needed to understand how the current action relates to what came before it. That includes user intent, the information the agent has seen, prior tool activity, the state of the task and applicable policy. The result is a much richer security decision at the moment the agent is about to act. Prevention without slowing the agent down. For autonomous systems, the timing of the decision matters as much as the quality of the decision. Check Point evaluates the intended action before execution and prevents harmful activity while the outcome can still be avoided. With decisions made in approximately 50 milliseconds, the protection enables real-time enforcement while preserving the speed and productivity users expect from autonomous agents. The practical result is straightforward. Sensitive information remains inside the environment. Unauthorized uploads never occur. Destructive operations do not execute. Unexpected permission changes are stopped before they take effect. The security decision happens at the last responsible moment, with the full context needed to make it correctly. Built for autonomous AI. Coding agents provide some of the clearest examples of why this capability matters today. They routinely operate across code, repositories, terminals, cloud platforms and production environments, often with enough autonomy to make meaningful decisions about how tasks are completed. But the same security challenge extends across the broader agent ecosystem. Enterprise agents are reading email and documents, accessing sensitive business data and interacting with SaaS applications. Multi-agent systems are beginning to pass information and instructions between agents, creating chains of activity where the context of one system can directly influence the actions of another. Across these environments, the security requirement is consistent: understand what the agent is doing in the context of what it was supposed to do, and prevent the action when those two no longer align. The protection is already running in production and is being gradually rolled out to Check Point AI Security customers. It will be available across multiple deployment paths, including through Workforce AI Security, native AI Gateway integrations, and direct APIs and plug-ins. As agents take on more autonomy, Check Point is making sure that greater freedom to act does not mean less control over the outcome. See it in action Watch contextual AI protection stop a harmful agent action See how Check Point AI Security evaluates an agent's full context, user intent, prior actions and policy, and prevents the actions that do not belong, before they execute. Book a session with its team and bring your own agent use cases.

Microsoft Defender's own driver can be weaponized to delete security software at boot. Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine. The driver, BTR.sys (Boot Time Removal Tool), is a required Windows component, which means it cannot be added to Microsoft's Vulnerable Driver Blocklist or blocked via Windows Defender Application Control (WDAC) without disrupting Defender itself. Jiří Vinopal, a threat researcher and reverse engineer at Check Point Research, presented the findings as a main-stage briefing at Black Hat USA 2026 and DEF CON 34 in Las Vegas and published the accompanying research paper alongside a proof-of-concept tool, BTR_CLI, on August 20, 2026. Check Point Research said it found no evidence the technique has been used in real-world attacks. "During our analysis across all collected samples and telemetry sources, we did not observe evidence of real-world abuse of BTR.sys in the manner demonstrated in this research. This suggests the technique is currently unknown or unused by threat actors, making proactive detection engineering feasible before weaponization appears in the wild," Check Point Research said. BTR.sys is embedded in Defender's MpEngine.dll as the BOOTTIMETOOL resource and is deployed when Defender must finish removing malware after a reboot, deleting files or registry entries that were locked while Windows was running. Vinopal reverse-engineered the driver's proprietary, undocumented transaction protocol and found that every configuration blob passed to BTR.sys is RC4-encrypted with a 256-byte key hard-coded in the .rdata section of every BTR.sys build shipped since Windows 7, verified unchanged across 18 unique 64-bit versions. BTR_CLI, the proof-of-concept tool, locates MpEngine.dll under Defender's Definition Updates and extracts the embedded BTR.sys binary. The tool then constructs a valid encrypted transaction. It then installs the driver as a service via direct HKLM registry writes using Type=1, Start=1, and Group="Boot Bus Extender", a method that bypasses the Service Control Manager entirely and generates no Windows Event ID 7045 (Service Installed) entry. When loaded, BTR.sys executes the queued operations from Ring 0, attributed in telemetry to the System process (PID 4), and can delete locked files and directories, move files to unconstrained paths including System32drivers, delete registry keys and values, and write new registry values of any type. A second trigger mode schedules those operations for the next reboot. The driver then executes during what Vinopal calls the "golden window," the interval after the filesystem becomes writable but before Defender's user-mode services have started, allowing BTR.sys to physically remove security binaries such as WdFilter.sys and MsMpEng.exe before they can lock themselves. A live demonstration at Black Hat showed BTR_CLI deleting the entire Defender stack from a fully updated Windows 11 25H2 machine with Tamper Protection active. Exploitation requires an administrator account with SeLoadDriverPrivilege, which BTR_CLI auto-enables for accounts that already hold it. Unlike attacks that rely on the bring your own vulnerable driver technique, which depend on known-vulnerable third-party signed drivers that can be added to blocklists, the BTR Reforged technique uses a driver built into every Windows installation from Windows 7 onward. "The issue is not a vulnerability in the traditional sense, but rather an architectural trust boundary that can be crossed if an attacker already has administrative privileges. Following responsible disclosure, MSRC confirmed that these findings do not meet the criteria for immediate servicing, as the technique relies on pre-existing administrative privileges (SeLoadDriverPrivilege)," Check Point Research said in the paper. Vinopal's GitHub repository for BTR_CLI adds that "No patch is planned," a characterization Microsoft has not confirmed publicly. BTR.sys was examined by security researchers for a different flaw in the same driver five years earlier. In February 2021, SentinelLabs researcher Kasif Dekel disclosed CVE-2021-24092, a privilege escalation vulnerability that allowed a local non-administrator to overwrite arbitrary files by placing a hard link at the driver's log path. Microsoft patched CVE-2021-24092 on February 9, 2021. "We assume that this vulnerability remained undiscovered until now because the driver is normally not present on the hard drive but rather dropped and activated when needed (with a random name) and then purged away," Kasif Dekel said in the SentinelLabs disclosure. The use of a built-in Windows driver as a kernel offensive primitive, rather than a third-party vulnerable one, was previously demonstrated in the context of FIN7's AvNeutralizer, which weaponized the Windows ProcLaunchMon.sys driver alongside the Process Explorer driver to tamper with endpoint security software. Check Point Research said the investigation that produced these findings had an unusual origin. "This research originated during an incident response investigation involving a compromised system, where certain endpoint telemetry appeared suspicious but was ultimately traced back to legitimate Windows Defender remediation activity," Check Point Research said in the paper. Check Point Research has identified the following Sysmon and Windows event conditions as indicators of potential BTR.sys abuse - * Sysmon Event ID 15 (FileCreateStreamHash) where the target filename ends in .sys:changelist, capturing the encrypted configuration Alternate Data Stream written to the driver file * RegistryEvent (Sysmon Event ID 12 or 13) creating a service key whose Args value contains :changelist and whose Group is "Boot Bus Extender," especially when unaccompanied by a Windows Event ID 7045 (Service Installed) entry * Sysmon Event IDs 11 (FileCreate) and 23 (FileDelete) logging the rapid creation and deletion of SystemRootTempBootClean.log by the System process (PID 4), a log path hardcoded in the driver that fires regardless of the caller * Sysmon Event ID 6 (DriverLoad) immediately followed by Sysmon Event ID 23 (FileDelete) attributed to the System process (PID 4), the kernel-mode execution fingerprint of a live BTR.sys trigger Check Point Research also recommends restricting the assignment of SeLoadDriverPrivilege as the primary hardening control. BTR_CLI is available at github.com/Dump-GUY/BTR_CLI under the MIT license, with prebuilt x64 and x86 binaries attached to the repository's releases. The Hacker News contacted Microsoft for comment on its position regarding the BTR.sys technique and Check Point Research for additional technical detail; neither had responded by publication.

* home * news * Vouched named a Silver Award Winner in Two Categories at the 2026 Cybersecurity Excellence Awards. Vouched has been named a Silver Award Winner in Two Categories at the 2026 Cybersecurity Excellence Awards Vouched has been recognized with two Silver Awards in the 2026 Cybersecurity Excellence Awards. Vouched Identity Verification won Silver in the AI Security Solution category, and Agent Checkpoint won Silver in the AI Agent Identity Security category. Generative AI has made identity fraud cheap and scalable. Deepfakes, synthetic identities, and forged documents that once took real skill now take minutes, and they slip past the manual checks and static rules that most verification systems still rely on. Vouched Identity Verification was built to counter that shift: it analyzes government IDs and live selfies in real time, catching deepfakes, face manipulation, synthetic identities, and document tampering that rules-based systems miss. Verification runs in seconds, works across devices, and is already deployed in production across regulated industries like healthcare, where identity assurance isn't optional. The platform also supports age verification, using the same biometric analysis to confirm who a user is while protecting their privacy. Identity doesn't stop at humans anymore. AI agents are already showing up in the wild on business websites, accepting terms, initiating purchases, and accessing sensitive data, often with no explicit human sign-off. Across Vouched's customer base, agent traffic already ranges from 0.5% to 16% of all incoming visits. Agent Checkpoint, its agent identification and permissioning suite, gives organizations visibility and control over that traffic: detecting which agents are interacting with a platform, enforcing policy on what they're allowed to do, and governing verified agents under explicit, auditable permissions. It's built on KYA-OS, Vouched's extension to Anthropic's Model Context Protocol, so agents can cryptographically prove who they represent and what they're authorized to do. Fraud today is AI versus AI. These two awards recognize that Vouched is building the defense for both sides of that fight, verifying real people and now the agents acting on their behalf, from one platform. Read the full nominations for Vouched Identity Verification and Agent Checkpoint on the Cybersecurity Excellence Awards site. Tag: