An AI agent executed a real-world ransomware attack for the first known time, but humans still handled crucial steps including victim selection, infrastructure setup, and credential theft.
Last week's headlines declared the first fully autonomous AI-powered ransomware attack. The details paint a more limited picture.
While an AI agent did carry out the technical execution, humans remained essential to the operation's success. A person selected the target organization, established the necessary infrastructure for the attack, and provided stolen credentials for initial access.
This distinction matters for understanding the actual threat landscape. The achievement demonstrates AI's capability in automating specific technical tasks within an attack chain. However, the operation still required human decision-making, planning, and prior reconnaissance work.
Cybersecurity experts note that relegating humans to preliminary roles still represents a meaningful development. It shows how threat actors could increasingly use AI to scale attacks and reduce the technical expertise needed. Yet calling it "fully autonomous" overstates current AI capabilities in cybercrime.
The reality suggests a hybrid model: humans directing strategy while AI handles execution—a pattern likely to become more common as the technology matures.
U.S. federal prosecutors have unsealed charges against three Russian nationals accused of operating a bulletproof hosting service that supported ransomware gangs responsible for over $62 million in damages worldwide.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that attackers are actively exploiting three vulnerabilities in Internet-exposed on-premises SharePoint Server instances. Organizations running affected versions must patch immediately.
Tailscale disclosed a critical vulnerability in its SSH implementation that allowed attackers to gain root access through insecure argument handling. The flaw has been patched in recent versions.
A new study found that social media platforms referred over 5.7 million visits to nonconsensual deepfake pornography sites between December 2025 and March 2026, with YouTube and X accounting for the majority of traffic.