Hackers are now turning your own company’s artificial intelligence tools into weapons against you, a new survey finds, with 84% of ransomware victims saying AI played some role in the attack that hit them.
Quick Take
- Cybersecurity firm Semperis surveyed 1,200 IT and security professionals across nine countries and found 84% experienced ransomware attacks involving AI in some way.
- The breakdown splits into 40% who faced a fully AI-based attack and 44% who saw hackers manipulate the victim’s own AI systems.
- Critics note the report lacks clear fieldwork dates, a named research firm, and a precise definition of what counts as “AI involvement.”
- The findings echo a 2025 Massachusetts Institute of Technology (MIT) Sloan paper that made a similar claim before researchers pulled it apart and shelved it.
What The New Ransomware Survey Actually Found
Semperis released its 2026 Ransomware Risk Report on October 14, polling 1,200 IT and security professionals across nine countries and eight industry sectors. The headline number: 84% of respondents said they experienced an attack that exploited artificial intelligence in some form. That figure splits further: 40% reported a fully AI-based attack, and 44% said hackers hijacked their own AI agents or systems.
The timing matters. Semperis says it had already flagged this coming. A year earlier, 74% of companies it surveyed worried AI would worsen identity-based attacks, and 73% feared criminals would use AI to break into networks. Those fears, the company argues, proved accurate. Outlets from CBS News to The Hill picked up the story fast, treating the 84% figure as evidence that AI has become a standard tool in the ransomware playbook.
Semperis's 2026 report surveyed 1,200 IT/security pros across 9 countries — real ransomware victims only. 84% of attacks used AI. 87% targeted AD/Entra ID/Okta. Just 50% back up identity systems separately.https://t.co/pABQ1tC08g
— Bugtraq Solutions (@BugtraqSolution) October 15, 2026
Why Skeptics Are Pumping The Brakes On The Headline Number
Not everyone is buying the number at face value. The Eastern Herald pointed out that 84% reflects what survey respondents believe happened, not a forensic count of confirmed attacks. That’s an important distinction. A company’s IT staff saying “we think AI was involved” is different from a security analyst proving malware code was AI-generated or AI-directed step by step.
The Eastern Herald also flagged missing details: no named research firm, no clear fieldwork dates, and no explanation of who qualified as a respondent or how “AI involvement” was defined. Runtime Wire added that Semperis’s own materials weren’t even consistent, citing an 87% figure in one release and 84% on the live report page. Small inconsistencies like that don’t disprove the trend, but they do mean readers should treat the exact percentage as a survey snapshot, not a scientific measurement.
This Isn’t The First Time A Big AI-Ransomware Number Got Challenged
This pattern has happened before, and recently. In 2025, a paper linked to Massachusetts Institute of Technology (MIT) Sloan claimed 80.83% of over 2,800 recorded ransomware events involved AI. Security researchers tore into it, saying it offered no real dataset or clear definition of “AI-enabled,” and the paper was eventually withdrawn. The lesson isn’t that AI-driven ransomware is fake. It’s that dramatic round numbers need real evidence behind them before anyone treats them as settled fact.
The broader direction isn’t in dispute. Criminals are clearly using AI for phishing emails, faster reconnaissance, and automating parts of an attack that used to take a human hours. Semperis reported 69% of victims faced repeat ransomware attacks, a sign the threat is compounding, not shrinking. Whether AI touched 84%, 40%, or some other slice of those incidents, the underlying message for American businesses and families is the same: the tools hackers use are getting smarter, and defenses built for yesterday’s threats won’t cut it tomorrow.
For everyday readers, the practical takeaway matters more than the statistic. Companies holding your personal data, medical records, and bank details need to treat AI-powered threats as real and current, not theoretical. Skepticism toward one vendor’s exact percentage is healthy and smart. Dismissing the trend entirely because the number isn’t perfectly sourced would be a mistake with real consequences for anyone whose data sits on a corporate server.
Sources:
cbsnews.com, easternherald.com, newser.com, thehill.com, ground.news
