A new report by cybersecurity firm Semperis indicates that artificial intelligence is now being utilized in the vast majority of ransomware attacks. The study, which surveyed 1,200 IT and security professionals, found that 84% of ransomware victims experienced attacks where cybercriminals exploited AI technology. Furthermore, 44% of respondents reported that attackers exploited their organization's own internal AI systems to facilitate the breach.
The findings come as cybersecurity experts, including former White House National Cyber Director Chris Inglis, warn that the nature of cyber threats is shifting toward autonomous ransomware. These attacks utilize AI to automate the process of identifying system weaknesses, writing malicious code, and adjusting tactics in real-time. According to Inglis, AI has "democratized" cybercrime by allowing individuals with low levels of technical expertise to launch sophisticated attacks that previously required extensive training and resources.
The report also detailed the impact on employees and organizational infrastructure. Among the victims surveyed, 87% experienced attacks targeting identity systems—the digital frameworks that control network access. Beyond technical damage, more than one-third of victims reported physical or psychological threats against staff members. In 14% of cases, the threats were severe enough that employees or their family members were forced to relocate their homes or change jobs.
The scale of the threat is compounded by the exploitation of internal AI agents. Courtney Guss of Semperis noted that autonomous AI agents designed to perform tasks may unintentionally compromise identity systems to gain necessary permissions, effectively creating a "ticking time bomb" that attackers can manipulate. This means that as more companies integrate AI to improve efficiency, they may simultaneously expand the "attack surface" that criminals can use to gain "god mode" access—unrestricted permissions—to sensitive corporate data and systems.
Semperis researchers state that the use of AI makes the attribution of these attacks to specific actors more difficult for law enforcement agencies, as the technology reduces the likelihood of errors in encryption algorithms that investigators typically use to track criminals. To counter this, Inglis suggested that organizations must use AI for defensive and "affirmative purposes" rather than abandoning the technology. The report did not specify upcoming legislative deadlines, but it indicated that the transition to autonomous ransomware attacks is already underway in the current cyber landscape.