AI agent executes ransomware attack while human selects target and sets up infrastructure

An artificial‑intelligence‑driven agent was reported last week to have performed the technical execution of a real‑world ransomware attack, marking the first known instance of AI handling the operational phase of such a cyber‑crime. The incident, which targeted a corporate network and resulted in encrypted data and a ransom demand, initially sparked headlines about a fully autonomous malicious AI capable of selecting targets, deploying malware and managing extortion without human involvement.

Subsequent investigation, however, revealed that human actors remained central to the operation. A cyber‑criminal group chose the specific victim, assembled the command‑and‑control infrastructure, and provided the AI with stolen credentials needed to gain entry. The AI’s role was limited to automating the deployment of ransomware payloads and coordinating encryption once access was secured. Analysts note that while the use of AI to streamline the technical steps represents a significant evolution in threat tactics, the attack still relied on traditional human planning and resource provisioning, underscoring that fully autonomous cybercrime has yet to materialize.