44% of ransomware victims say attackers exploited their own AI tools. What to check in your office

What's new

On Oct. 14, Semperis, a company that sells identity security and recovery tools, released its third annual Ransomware Risk Report. According to The Hill's report on the study, Semperis and the research firm Censuswide surveyed 1,200 IT and security professionals in nine countries and eight industries.

Most headlines led with the big number: 84% of attacks used AI in some way. The number we'd look at is a smaller one. 44% of ransomware victims said their own AI agents or systems were exploited by attackers. Not AI in the hands of criminals. AI the company had set up for itself.

That matters for a mid-size office because so many have just connected an assistant to their email, shared drives or ERP in the past year. Each of those connections is a new door.

The numbers

What ransomware victims reported

Semperis 2026 Ransomware Risk Report. Survey of about 1,200 IT and security professionals; answers describe what respondents believe happened.

1. Attacks that targeted identity systems87%
2. Attacks that used AI in some way84%
3. Hit by ransomware more than oncepast 12 months69%
4. Paid a ransom59%
5. Own AI agents or systems exploitedof ransomware victims44%
6. Had a cyber insurance policy canceled or rate raised42%
7. Had automated identity recovery tools40%

Source: Semperis, 2026 Ransomware Risk Report, released Oct. 14, 2026.

A few more details from the report page and The Hill's coverage:

• Logins are still the main target. 87% of attacks went after identity systems: the directory and sign-in systems that decide who can open what. Only 50% of victims had dedicated backups of those systems.
• AI defenses didn't always hold. About 49% of victims used AI tools to detect and fight attacks, and 23% said those tools failed to stop the malware, as reported by The Hill.
• Fewer companies are paying. 59% paid a ransom, down from 69% last year and 78% in 2024.
• The pressure is getting personal. 57% of respondents got threatening texts, letters or packages, and 37% of attacks involved threats against friends or family of staff.

Semperis's CEO, Mickey Bresman, put the AI-agent problem plainly: "Organizations have no way of predicting what an AI agent will decide to do."

What "exploited their own AI" can mean

The report page doesn't break the 44% down, so we won't guess at the details. But the ways an office AI tool gets misused are well known. The OWASP Gen AI Security Project, a widely used security checklist, calls the core problem "excessive agency" and gives it three causes:

• Too many tools. The assistant can do things its job doesn't need, like send email when it only needs to read it.
• Too much access. It connects with an account that can see every mailbox or every folder, not just the ones its work needs.
• Too little review. It takes high-impact actions with no person approving them.

Put those together and a single tricked or hijacked assistant can read, copy or send far more than any one employee would. That's why an AI tool with access to your systems should be treated like a user account, with the same care you'd give a new hire's login.

An AI tool that can read your email is an account. Treat it like one.

What the other side has right

• It's vendor research. Semperis sells identity backup and recovery tools, and a report that finds identity systems under attack supports that business. We sell AI automation, so weigh our read the same way.
• It measures belief, not attacks. The Hill notes the 84% reflects what respondents believe, not confirmed AI use. Victims may credit AI for attacks that didn't need it, or miss it where it was used.
• The sample is the big picture, not your size. Neither the report page nor the coverage we read breaks results out by company size or gives fieldwork dates.
• Some good news is buried. Fewer victims are paying, which suggests backups and recovery plans are working for more companies.

None of that changes the direction. You don't need the 44% to be exact to see that an AI tool with wide access is a new target.

Our take for a 40-400 person company

This is the third warning in about a week pointing the same way. Microsoft's CEO said to treat AI models as if they could be compromised, and CrowdStrike found attackers using AI tools to break into business apps. The fix isn't to stop using AI. It's to set it up the way you'd set up any account that can touch money, customers or orders.

That's also how we build. The automation we put in an order desk reads a customer PO, checks it against the ERP, and puts it in front of a person who approves it. It doesn't get a key to every mailbox, and nothing it prepares reaches a customer or the ERP without someone saying yes. That design is about accuracy first, but it's also what keeps a hijacked tool from doing much harm.

What to check this month

1. List every AI tool that's connected to something. Email, shared drives, Teams, the ERP, the CRM. Include add-ons and anything an employee set up on their own.
2. Check what each one can reach. If an assistant only needs one mailbox, it shouldn't have access to all of them. Remove send, delete or write rights it doesn't use.
3. Protect the logins around it. Multi-factor sign-in on every admin and service account, and a short list of who holds admin rights.
4. Put a person on high-impact actions. Anything that sends to a customer, pays a vendor, or changes the ERP gets approved by someone.
5. Back up your directory, not just your files. Ask your IT provider how fast you could rebuild your user accounts and sign-ins after an attack, and when they last tested it.
6. Read the related guides: when AI agents went off script and the AI nobody approved.