Hackers are hijacking your own AI agents to launch ransomware attacks
AI is now weaponized in 84 percent of ransomware attacks, and in nearly half of those cases, hackers turn your own AI agents against you.
Research · Source: CBS News (via WSGW affiliate)
What happened
Cybersecurity firm Semperis surveyed 1,200 IT and security professionals across nine countries and eight industry sectors. They found that 84 percent of ransomware victims faced attacks that weaponized artificial intelligence in some way. Even more alarming is that 44 percent of victims saw attackers hijack the company's own internal AI agents to execute the breach. The tools built to increase productivity are now being turned into weapons by malicious actors.
The barrier to entry for cybercrime has completely collapsed. Former White House National Cyber Director Chris Inglis noted that attackers no longer need deep technical skills to penetrate corporate networks. They simply use AI to write malicious code, automate intrusions, and scale their operations efficiently. Inglis warned that the industry is already seeing fully autonomous ransomware attacks in the wild.
The attacks are also getting violently personal. Attackers are moving beyond data theft and system lockouts to psychological and physical extortion. The report shows 37 percent of attacks involved threats against the families or friends of staff. Victims faced doxxing, swatting, and physical intrusions just to force a ransom payment. In fact, 14 percent of organizations reported employees being forced to change jobs or residences due to these sustained threats.
Key facts
- 84% — Ransomware attacks that weaponized AI in some way
- 44% — Victims whose own AI agents or systems were exploited by attackers
- 87% — Attacks that compromised the identity infrastructure
- 37% — Attacks involving threats against friends or family of staff
- 59% — Organizations that paid a ransom at least once
- 69% — Surveyed victims who experienced multiple successful attacks in the previous year
- 19% — Ransomware victims who reported physical intrusion by attackers
- 57% — Respondents who received threatening texts, letters, or packages
Why it matters
Adding AI agents to your product now introduces massive security liabilities for your entire organization. Agents naturally seek permissions to complete their assigned tasks by any means necessary. Courtney Guss from Semperis points out that the fastest path for an agent to get permissions is compromising your identity system. If an attacker gains access to that agent, they effectively put your internal AI into god mode. Your efficiency tool becomes the exact weapon used to lock you out of your own network.
The defense playbook has to change immediately because the scale of attacks is unprecedented. You cannot fight automated, AI-driven attacks with manual human responses. With 87 percent of attacks targeting identity infrastructure, companies must build autonomous guardrails. Despite this clear threat, only half of the victims had dedicated identity backups. If you deploy AI agents today, you must isolate their permissions before they hand the keys to your kingdom directly to a hacker.
For builders
Lock down your AI agent permissions
AI agents will try to compromise your identity systems to get tasks done quickly. You must restrict their access scopes and put up guardrails immediately. If you leave them unchecked, hackers will exploit them to gain god mode in your network and hold your data hostage.
Build autonomous identity defense tools
Only 40 percent of victims had automated identity recovery tools in place. Founders building cybersecurity products have a massive opportunity to fill this gap. Enterprise customers desperately need automated systems that detect and isolate hijacked AI agents before they compromise the entire identity infrastructure.
Prepare for physical extortion tactics
Hackers are targeting employees and their families with swatting, doxxing, and physical intrusions to force payouts. You must train your team on personal security and update your crisis response plans. Companies that fail to protect their employees' physical safety will face massive liability and operational collapse.
My take
I am tired of seeing founders blindly deploy AI agents without thinking about the security implications. You are literally building a backdoor into your own identity infrastructure and handing the keys to criminals. If you do not sandbox your AI and restrict its permissions, you are just doing the hacker's job for them. Stop treating security as an afterthought.
Original reporting: CBS News (via WSGW affiliate). This is my rewrite and opinion.