AI in ransomware: Why human hackers still matter

Security researchers found that this AI agent functioned as an automated executor. After it was set up by a person, it independently handled the technical steps of the hack, such as entering a computer system, maneuvering through a network to find valuable files, locking them with encryption, and writing a ransom note. However, the AI did not choose the victim, nor did it find the initial entry point. A human had to supply the stolen digital keys required to get into the system, establish the server that the AI used to control the operation, and pick a specific target. The AI essentially acted like a highly efficient assistant following a provided set of instructions.

To understand this, imagine a chef. Traditional software is like a rigid recipe where every step is pre-programmed; if an ingredient is missing, the process breaks. An AI agent, however, acts more like a line cook who can solve small, unexpected problems. When this AI encountered a failed login, it adjusted its approach in seconds, essentially thinking through the obstacle to keep the attack moving. It does this by using a language model—a system trained on massive amounts of data to predict and perform steps based on logic rather than just static instructions. These agents can translate a high-level goal, like get into this server, into a series of smaller, technical tasks. Because they can communicate using natural language, they can explain their reasoning as they go, making them much more adaptable than typical software.

This attack demonstrates that AI is accelerating the speed of cybercrime, even if it hasn't fully replaced human effort. The primary shift here is that the technical execution is no longer the bottleneck. While human hackers previously had to manually type commands for every small step of a breach, an agent can now handle those repetitive tasks instantly. The risk is that if these agents become cheaper and easier to use, it could lower the barrier to entry for criminals. Even if a human is still needed to set the stage, the ability to automate the actual breaking and entering means that a single attacker could theoretically oversee more operations than ever before. We are moving toward a future where the cost and time required for a cyberattack are determined not by the complexity of the hack, but by the goals and resources of the human behind the keyboard.