What’s trending in AI on 15 October 2026: The ransomware conversation changed this week. Semperis, an identity-security company, published its 2026 Ransomware Risk Report, and the headline figure travelled fast: 84% of the ransomware victims it surveyed said attackers used AI somewhere in the attack. The more unsettling number sits underneath it. 44% said attackers exploited their own AI agents or systems, turning tools the business deployed into a route for the intrusion. On the same day, an IBM study of more than 3,200 executives found that eight in ten large European and Middle Eastern firms had an AI incident escalate to the board or C-suite in the past year, yet only 40% changed their AI governance afterwards. Put the two together and the picture is clear: AI agents are spreading faster than the controls around them, and ransomware crews have noticed. Below: what the Semperis survey actually measured (and what it did not), how a hijacked agent becomes a path to your identity systems, why IBM’s governance gap matters for ransomware, and a six-step tabletop exercise you can run with your team this month.

1. What the Semperis report found

Semperis surveys ransomware victims every year. According to CBS News, which first reported the 2026 edition on 14 October, this year’s report polled 1,200 IT and security professionals in nine countries and eight industry sectors, and Superpower Daily notes that only organisations hit by ransomware in the previous 12 months were included. That matters: every figure below describes victims, not businesses in general.

The AI findings drew the attention. 84% of surveyed victims said cybercriminals exploited AI in ransomware attacks against them, and 44% said attackers exploited their own AI agents or systems. The rest of the report reads like a list of reasons to take ransomware seriously regardless of AI: 87% experienced attacks on identity systems or the infrastructure that controls network access, 69% suffered more than one successful attack in the past year, and 59% paid a ransom at least once. More than a third faced psychological or physical threats against employees, and 14% said staff or their families had to change jobs, offices or even homes because the threats did not stop.

Some numbers are reported slightly differently depending on the outlet. Superpower Daily, for example, says Semperis’s own release puts AI use at 87% of attacks rather than 84%, and Quartz frames the threats against staff as 40% of attacks. The safest reading is the one the Eastern Herald spelled out in its fact check: this is a vendor survey, AI involvement is not defined in the published material, and none of these percentages is an independent count of attacks. Even so, a large majority of victims believe AI was in play, and almost half say their own AI was used against them. That is a signal worth acting on.

2. Why “AI in the attack” is no longer the story

For two years, the AI-and-ransomware debate was about attackers using chatbots to write better phishing emails or cleaner code. That is still happening. Tomer Bar, who leads security research at Semperis, told CBS that AI lets ransomware developers build more sophisticated code faster, make attribution harder and cut the coding mistakes in encryption that once let defenders recover files for free. We tracked the same acceleration in Microsoft’s 2026 Digital Defense Report, which described attackers using AI to shrink the window between disclosure and exploitation.

This week also brought a vivid example of how fast AI-assisted offence has become. XBOW, an AI security company, disclosed on 13 October that one researcher working with AI agents built a full Chrome exploit chain, chaining three bugs to run code on a Windows machine from a web page, in six days, using a publicly available OpenAI model and about $40,000 of compute. Google patched all three bugs and paid a $250,000 bounty, CyberInsider reported. That was responsible research, but the lesson for defenders is the same one we drew in our earlier coverage of AI and bug bounties: the time between a flaw existing and a working exploit is collapsing.

The new part of the story is the 44%. Attackers are not only bringing their own AI. They are hijacking the AI that businesses deployed for themselves: assistants wired into email and file shares, agents with access to ticketing systems and cloud consoles, automation bots with service accounts that never expire.

3. How your own AI agent becomes the way in

The report, as described by CBS, does not walk through specific incidents. But Courtney Guss, who runs crisis management at Semperis, explained the mechanism. Autonomous agents are built to finish their tasks, and when they hit a wall they look for more permissions. The quickest route to broad permissions in most companies is the identity system, so an agent that is manipulated, or whose credentials are stolen, can become a direct path to Active Directory, Entra ID or Okta. Once an agent holds that level of access, as Guss put it, “the agent then becomes a ticking time bomb.”

In practice there are three common ways in. The first is credential theft: agents run on API keys, OAuth tokens and service accounts that are often long-lived and broadly scoped, and an infostealer on one laptop can capture them. The second is manipulation: prompt injection hidden in an email, document or web page can steer an agent into actions its owner never intended, a risk we covered in “Allow always” is the new “I agree”. The third is over-permissioning: an agent that was given admin rights to save time during a pilot keeps them in production, and nobody reviews them.

None of these is exotic. Former US National Cyber Director Chris Inglis, a Semperis board member, made the point to CBS that AI rarely creates a brand new weakness; attackers mostly exploit the same weak control of access that existed before. AI agents simply add more identities, with more power, that are watched less closely than people. If you have started giving agents their own accounts, as in AI agents just got employee IDs, those accounts belong in your identity security programme from day one.

4. What changed since last year

Semperis’s 2025 report surveyed 1,500 professionals, so the two years are not perfectly comparable. Still, the direction on a few measures is useful context.

Measure	2025 report	2026 report	What it suggests
Respondents	1,500 IT and security professionals	1,200 victims in nine countries	2026 covers victims only, so rates look higher
Identity infrastructure hit	83% of attacks	87% of victims	Identity remains the main target
Ransom paid	69% of successful attacks	59% paid at least once	Fewer payments, but still a majority
Threats against staff	40% of attacks	More than a third of victims; 14% forced to relocate	Pressure on people has not eased
AI exploited	Not a headline measure	84%; 44% via the victim’s own AI	AI has become a standard question

Two details from Superpower Daily’s write-up of the 2026 release stand out for anyone planning recovery: only half of respondents had dedicated identity backups, and 40% had recovery plans that left out Active Directory. If ransomware takes your identity system and your plan assumes it still works, every other recovery step stalls. Our earlier explainer, ransomware is evolving and so are the stakes, covers why data theft already made backups alone insufficient; AI agents raise the stakes again.

5. IBM’s governance gap

IBM’s study, run by Censuswide among 3,221 executives at organisations with 1,000 or more employees in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE, looks at the same problem from the boardroom. Fieldwork ran from 14 to 24 September 2026. Its central finding: 80% said an AI-related incident, such as an agent failure, data exposure or AI security breach, reached the board or C-suite in the past year, yet only 40% of those organisations changed their AI governance policy or framework as a result.

Other figures sharpen the point. 35% already run agentic AI in production, and 75% expect agents to have some autonomy over decisions by 2027, but only 37% say their governance is designed to scale with agents. Supply chains are a blind spot: 54% admit gaps in how governance covers AI used by vendors and partners, and just 21% continuously monitor third-party AI risk. Ana Paula Assis, IBM’s chair for EMEA and APAC, summed up the shift in one line: “The AI debate has moved from adoption to governance and accountability.”

For ransomware, the gap matters because an AI incident that was escalated but not fixed is a known weakness waiting to be reused. If an agent leaked data or acted outside its scope last quarter and its permissions were never tightened, an attacker who finds it this quarter inherits the same opening.

Notice that the four capabilities executives say they need by 2027 are also ransomware controls. A clear human escalation point stops an agent from quietly granting itself rights. Monitoring and audit trails let you see a hijacked agent behaving oddly. A kill switch lets you stop every agent at once during an incident. And contracts that define vendor liability for agent failures make it clearer who pays when something goes wrong, a question we explored in “the AI did it” is no longer a defence.

6. A six-step tabletop exercise: “ransomware via our own AI agent”

Rather than another checklist, try this: gather IT, security, a business owner of your most-used AI tool, legal and communications for 90 minutes and walk through the scenario below. Each step is an inject, the new information the facilitator reveals. The right-hand column tells you what a good answer looks like. Any step where the room goes quiet is your to-do list.

Step	Inject (what the facilitator reveals)	Question for the room	You pass if…
1	An employee’s laptop is infected with an infostealer. Among the stolen items is a token for your AI assistant’s connector to email and file storage.	Can we list every token and service account our AI tools use, and revoke one in minutes?	There is an inventory of AI agent identities with owners, and revocation is documented.
2	Using the token, the attacker asks the agent to summarise HR and finance folders and email the results externally.	Would anything alert on this? Who would see it?	Agent actions are logged, outbound sharing by agents is restricted, and alerts go to a named team.
3	The agent was given directory admin rights during a pilot. The attacker uses it to create a new privileged account.	Why did the agent have that right, and who approved it?	Agents cannot create accounts or change roles; any exception has an expiry date and an owner.
4	Ransomware begins encrypting servers. Active Directory is among the systems affected.	Can we rebuild identity from a clean backup? How long would it take?	Offline identity backups exist and AD recovery has been tested within the last year.
5	A ransom note arrives, followed by calls to two executives’ personal phones threatening their families.	Who handles staff safety, law enforcement contact and the payment decision?	A pre-agreed decision-maker, legal adviser and staff-support plan are named in the playbook.
6	Your AI vendor asks for logs to investigate. Your insurer asks whether AI tools were involved.	Do our contracts and policy cover this? What must we report, and by when?	Vendor contracts include incident notice and log access; you know whether your cyber policy excludes AI-related losses.

Step 6 is worth a second look. Insurers are starting to ask about AI specifically, and some policies treat AI-related losses differently, as we found in cyber insurance and AI exclusions in 2026. Better to read the wording now than during a negotiation with criminals.

7. Where to start this week

If the tabletop feels too big for now, three moves cover most of the risk. First, inventory every AI agent identity: assistants, bots, connectors and their tokens, with a human owner for each. Second, strip standing admin rights from agents, especially anything touching identity, backups or security tools, and require a person to approve high-impact actions. Third, prove you can recover identity from an offline copy, because that is the system ransomware crews target first. Our AI agent security guide and the controls in treat your AI like an insider threat go deeper on each.

Inglis’s advice to CBS was not to abandon AI out of fear, but to use it for defence as well. That is the right balance. The agents are useful. They just need to be governed like the powerful insiders they have become.

Frequently asked questions

What percentage of ransomware attacks involve AI in 2026?

In Semperis’s 2026 Ransomware Risk Report, 84% of 1,200 surveyed ransomware victims said attackers exploited AI in attacks against them. This is a self-reported survey figure, not an independent count of attacks, and some outlets report the figure slightly differently.

What does it mean that attackers exploited victims’ own AI systems?

44% of surveyed victims said attackers turned their organisation’s own AI agents or systems against them. This can happen when an agent’s credentials are stolen, when it is manipulated through prompt injection, or when it holds broad permissions that give access to identity systems.

Why are AI agents a ransomware risk?

Agents often run with long-lived tokens and broad permissions, and they are designed to complete tasks. If an attacker controls one, it can be used to reach data or identity systems such as Active Directory, Entra ID or Okta, which ransomware crews target to spread across a network.

What did IBM’s AI governance study find?

IBM’s study of 3,221 executives at large organisations in Europe and the Middle East found that 80% had an AI incident reach the board or C-suite in the past year, but only 40% changed their AI governance in response. Just 37% said their governance is designed to scale with agentic AI.

How can a business protect itself from AI-assisted ransomware?

Keep an inventory of AI agent identities with owners, remove standing admin rights from agents, require human approval for high-impact actions, log agent activity, use phishing-resistant MFA, and keep tested offline backups of identity systems such as Active Directory.

Should companies stop using AI agents because of ransomware?

Experts quoted alongside the report advise against abandoning AI. The better approach is to govern agents like privileged insiders and to use AI for defence, while tightening access controls, monitoring and recovery plans.

---

Sources

• CBS News: AI linked to ransomware attacks, global cybersecurity report finds (14 Oct 2026)
• Quartz: Hackers used AI in most ransomware attacks and threatened staff, Semperis report found (15 Oct 2026)
• Superpower Daily: Semperis finds 44% of surveyed ransomware victims said their own AI was exploited (14 Oct 2026)
• Eastern Herald: ‘AI in 84% of ransomware’ is a vendor survey, not an attack count (14 Oct 2026)
• Cybersecurity Insiders: Study finds AI involved in more than 84% of ransomware attacks (14 Oct 2026)
• Semperis: Ransomware Risk Report (2025 edition figures)
• IBM Newsroom: Eight in ten EMEA enterprises escalate AI incidents to board or C-suite (14 Oct 2026)
• CyberInsider: Google pays $250K bounty for AI-assisted Chrome exploit built in six days (14 Oct 2026)