In recent weeks, AI has been impossible to ignore. What once seemed like the premise of a science fiction film has quickly become a series of real-world developments, raising as many questions as answers. As the conversation around AI continues to intensify, two urgent issues stand out: What is the true risk it poses, and what practical steps can be taken now to address it while there is still time?

Without delving into the economic, geopolitical, and almost existentialist debates surrounding this entire issue, and focusing instead on the reality of the healthcare sector, terms such as cyberattacks, hacking, or even research into pathogens harmful to health are a genuine cause for concern among professionals. What do we need to know? Because what does seem obvious is that the implementation of autonomous technologies in public services and critical infrastructure introduces new operational risks.

To shed light on some of these issues, El Médico Interactivo, part of the Medscape Professional Network, spoke with Mario García, country manager Iberia at Check Point Software Technologies, Spain and Portugal. The first point he clarified is that, at present, the main risks center on the emergence of more advanced attack vectors such as industrialized social engineering, data leaks resulting from the use of unregulated tools or “Shadow AI,” and the injection of prompts to manipulate models.

Attackers use AI to reduce the time needed to generate functional exploits to just minutes after a vulnerability is disclosed. However, AI is also essential as part of the solution for analyzing massive volumes of data in real time.

Healthcare Data Is Vulnerable

It is worth recalling that on September 15, the Spanish Data Protection Agency reported the first notification of a personal data breach allegedly carried out by an AI agent. This is a point worth noting, since the healthcare sector, in particular, holds a large portion of the population’s most vulnerable data — and also some of the data most sought after by hackers.

In the US, the Office for Civil Rights of the US Department of Health and Human Services reported that more than 19 million people were affected by healthcare data breaches in the first 6 months of 2026.

Part of the challenge lies in healthcare’s unique vulnerability. The sector includes a wide range of stakeholders, both public and private, of different sizes and subject to different regulatory frameworks. At the same time, these organizations rely on a growing number of network-connected devices of all kinds, many of which are increasingly equipped with AI capabilities.

“This coexistence creates disparities in technical maturity among supply chain actors, making it difficult to maintain consistent security policies across heterogeneous environments and complicating the regulatory landscape when attempting to harmonize laws such as the European Union’s Artificial Intelligence Act, which sets rules for the development and use of AI systems, with healthcare privacy,” García noted.

A Kill Switch

The situation changes when AI goes beyond simply providing a response and gains the ability to take actions. In healthcare, this can affect clinical decision-support systems, documentation tools, medical devices, or platforms connected to other systems. The greater the degree of autonomy, the greater the importance of being able to monitor, limit, or halt its actions.

For that reason, experts say there is a growing need for legal frameworks that incorporate built-in control measures, including emergency “kill switches,” designed from the outset under a security-by-design approach to help limit the impact of system failures or cyberattacks on automated systems.

“Legislation should require an emergency shutdown button, or ‘kill switch,’ for AI systems when things go wrong because they inevitably will at times. Autonomous technology could deliver major economic benefits, but clear checks and balances are essential, especially in critical public services,” García said.

In the specific case of healthcare, this so-called “kill switch” must be contextualized. It should not be conceived as an abrupt shutdown that obstructs medical care but works through logical isolation and securing of automated mitigations managed by cybersecurity teams to prevent disruptions in patient care.

For this reason, experts advocate for prevention strategies and continuous exposure management because this is the only way to identify, prioritize, and apply virtual patches to vulnerabilities to reduce risk before adversaries can act.

AI for Finding Cures or Designing Biological Threats

Another point of public debate is that we all know AI can change — and is already changing — the way research is conducted and that great hopes are pinned on its ability to discover new molecules for many diseases and even find cures for others. However, the problem lies not only in the tool itself but also in its use; just as it can be used to benefit public health, it can also be used to undermine it.

Another news story that has drawn attention in recent weeks is that the AI company Anthropic released a report explaining how it had blocked several attempts by users throughout 2026 to create dangerous pathogens, raising the question of whether AI could ultimately contribute to the development of biologic weapons.

The use of AI in research is already quite advanced. Stanford University in Stanford, California, has just unveiled Virtual Biotech, a multiagent AI system designed to inform decision-making in drug development. So far, the Virtual Biotech company has managed to discover a biologic marker that predicts which drug candidates are most likely to succeed and has designed a cancer therapy that was subsequently developed independently by a major pharmaceutical company.

On this issue, García stated, “to counteract the automation and creation of advanced threats using AI, the response cannot be reactive or rely solely on late detection. It is essential to implement a cybersecurity strategy based on prevention by default, designed to stop zero-day attacks and threats.”

In conclusion, García emphasized that “in a sector as critical as healthcare, the key is to adopt technological innovation without compromising operational continuity or patient trust.” This is something for which human professionals remain indispensable. “The medical community must maintain visibility into the tools in use, establish health data governance, and train its staff on new impersonation techniques.”

Check Point Software Technologies, a global cybersecurity company, works to ensure AI-driven transformation for businesses. 

This story was translated from El Médico Interactivo on Univadis, part of the Medscape Professional Network.