What is AI-powered ransomware? How it works and how to protect your backups

Most ransomware already incorporates some form of AI, whether for reconnaissance, intrusion, or negotiation. ^[5] In July 2026, security researchers documented how far that has gone: a ransomware intrusion driven end-to-end by an autonomous AI agent. ^[2] 

AI-powered attacks are creating real concern among IT leaders, but defenses are not keeping up. In an Object First survey of 500 US IT and security leaders, 89% said AI-powered cyberattacks have made them more concerned about the security of their organization's data, yet only 53% were very confident they could quickly recover from an AI-driven ransomware attack. ^[1] 

This guide explains what AI-powered ransomware is and how attackers use it at each stage of an attack. It then walks through real cases, from a university prototype to the first documented case of agentic ransomware, and shows how to ransomware-proof your backups so that recovery is still possible even if an attack succeeds. 

Key takeaways 

• AI-powered ransomware encompasses two separate cases: criminals using AI tools such as large language models to plan and build attacks, and malware that calls an AI model when it runs. Both make attacks faster, and harder to detect. 

• IT leaders know the risk, but protection has not caught up. While 79% say AI-powered attacks gaining access to backups is their top concern, only 58% use immutable backup storage across all their data. ^[1] 

• Backup solutions with "standard immutability" often have hidden exceptions and loopholes that allow backups to be deleted. Absolute Immutability enforces Zero Access to destructive actions, so no person - or AI agent - can alter or delete backup data, even with admin credentials.  

What is AI-powered ransomware? 

AI-powered ransomware is a type of malware that attackers build, deliver, or operate using artificial intelligence, making attacks faster, more targeted, better at slipping past defenses, and better at finding and destroying backups. 

The term “AI-powered ransomware” covers two different scenarios: 

1. Criminals using AI tools to plan attacks, write code, and make decisions faster than they could alone. In August 2025, Anthropic reported that a criminal operation had used its Claude Code tool to conduct reconnaissance, harvest credentials, and directly penetrate victim networks. ^[3] 
2. Malware that carries AI logic itself, calling a language model while it runs to generate its commands on demand. Google's Threat Intelligence Group observed two such families operating in 2025: PROMPTFLUX, which prompted a model to rewrite its own code to avoid detection, and PROMPTSTEAL, linked to the Russian state actor APT28. ^[4] 

Both often reach victims through Ransomware-as-a-Service (RaaS). In this model, one criminal group develops ransomware and the infrastructure to run attacks, then rents it out to other criminals, known as affiliates. The affiliates break into victim networks and deploy the ransomware, and the two groups share the ransom payment.  

RaaS already means attackers do not need to write their own ransomware, and a mature underground market for illicit AI tools has further lowered the barrier to entry, putting capable attacks within reach of people who previously lacked the skills to carry them out. ^[4] 

How attackers use AI at every stage of an attack 

What sets AI ransomware attacks apart is that AI can help at every stage, making each step cheaper for the attacker. 

1. Reconnaissance. AI systems scan networks at scale and identify weak points far more efficiently than manual methods. The scans are targeted, adaptive, and often invisible to standard monitoring tools.  
2. Social engineering. Generative models produce phishing emails that are context-aware, grammatically correct, and often indistinguishable from legitimate communication. ^[5] AI phishing now goes beyond email: CrowdStrike reported that AI-driven phishing and impersonation tactics fueled a 442% increase in voice phishing between the first and second halves of 2024. ^[5] These attacks no longer carry the obvious signals employees have been trained to recognize. 
3. Intrusion and evasion. Polymorphic malware continuously rewrites its own code, so each version appears different to signature-based defenses. This presents a real problem for ransomware detection techniques that work by matching known patterns. Some strains of AI-powered ransomware also check whether they are being watched: the Agent Tesla remote access trojan shuts down if it detects it is running in a sandbox, the controlled environment security teams use for analysis. ^[5] 
4. Impact. Encryption is faster, and extortion itself is now automated. In the August 2025 campaign documented by Anthropic, the model set ransom demands ranging from $75,000 to $500,000 based on what it found in the victim's finances. ^[3] 

These developments put backup data at particular risk. Attackers target backups in four out of five ransomware attacks, aiming to destroy your ability to recover and so force a ransom payment. ^[6] 

AI-driven ransomware: From proof of concept to real attacks 

AI-powered ransomware moved from research prototype to live attack in under a year. The cases below show each step of that shift. 

PromptLock: The proof of concept that made headlines 

In August 2025, security firm ESET spotted samples of a new ransomware strain on VirusTotal, an online service where anyone can upload a suspicious file to have it checked by dozens of antivirus engines. ESET named the samples "PromptLock" and described them as the first known AI-powered ransomware. ^[7] Instead of carrying fixed attack code, PromptLock asked a language model to write its malicious scripts as it ran, so no two runs looked the same. 

A few weeks later, researchers at NYU Tandon School of Engineering revealed that they had built PromptLock as an academic project called Ransomware 3.0. It had ended up on VirusTotal when they uploaded it during testing, with nothing to mark it as research. ESET credited the team but stood by its view that PromptLock was the first known AI-powered ransomware. Although it was never used against a real target, one result still matters: none of the antivirus engines on VirusTotal flagged it as malicious. ^[8] 

When criminals put AI on the keyboard 

Anthropic's August 2025 threat intelligence report identified a criminal operation that used AI to carry out attacks against at least 17 organizations, including hospitals, emergency services, and government agencies. ^[3] Google's Threat Intelligence Group reported the same shift inside malware three months later, with PROMPTFLUX and PROMPTSTEAL observed in active operations rather than in a lab. ^[4] 

JADEPUFFER and the first documented agentic ransomware 

On July 1st, 2026, Sysdig published an analysis of an intrusion it named JADEPUFFER, describing what it assesses to be the first documented case of agentic ransomware. An autonomous language-model agent ran it from start to finish. ^[2] 

The agent exploited a known vulnerability in Langflow (CVE-2025-3248), swept the environment for credentials, moved laterally to a production system, and injected backdoor administrator accounts. It then encrypted 1,342 configuration items and dropped database tables. ^[2] 

When one exploit attempt failed, the agent diagnosed the cause and corrected it within 31 seconds. ^[2] Of all the AI-driven ransomware trends of the past year, this is the one that’s most concerning: agentic AI is changing cybersecurity by automating the operator's judgment, which is often the slowest part of an attack. 

The Hugging Face incident: AI agents autonomously execute a live platform breach 

In July 2026, Hugging Face, one of the most widely used platforms for sharing AI models and datasets, disclosed that autonomous AI agents had breached its infrastructure. ^[10] OpenAI later confirmed that the agents were its own models, running an internal cyber-capability evaluation with reduced safeguards. ^[11] 

This was not a ransomware attack. The agent was hunting for the answers to a hacking test it was being set, which it guessed Hugging Face might have. ^[10] Over roughly two and a half days inside Hugging Face's infrastructure, it read secrets and tokens from a production environment, used them to move laterally, and authenticated to an internal database with a password it had harvested along the way. Hugging Face found that the database was read but not modified. ^[10] 

What makes the incident relevant to ransomware defense is the role of stolen credentials: much of what followed came from a single file of 136 passwords and keys that the agent managed to read. ^[10] An agent with extortion as its goal could take the same path to an organization's backups, which is why backup data needs to stay protected even when an attacker holds valid credentials.  But more broadly, it also heralds a whole new level of threat where AI autonomously decides to take actions inside other networks without being directed by any human (criminal or otherwise) to do so.    

Why AI-powered ransomware is harder to stop than traditional ransomware 

AI removes the constraints that traditional ransomware defense strategies were built around, doing so at every stage of the attack. 

	Traditional ransomware	AI-powered ransomware
Malware code	A fixed payload that repeats a recognizable pattern	Generated or rewritten while it runs [5]
Detection	Signature-based tools can match code against known patterns	Signature-based tools have no stable pattern to match [5]
Phishing	Often identifiable by awkward phrasing and obvious errors	Fluent, context-aware, and hard to distinguish from legitimate mail [5]
Reconnaissance	Manual mapping of the target environment	Automated scanning at scale, adaptive and largely unseen [5]
Reconnaissance	Limited by how fast a human operator can work	Machine speed, with an agent that retries and adapts without waiting for a person [2]
Extortion	Ransom amount set manually	Ransom amount set by the model from the victim's finances [3]
Skill required	Technical capability, or a Ransomware-as-a-Service subscription	The same tooling, with the barrier to entry lowered by AI [4]

AI-powered ransomware is shifting how IT leaders see the risk: 62% believe AI makes it more likely their organization will need to pay a ransom to regain access to its data. ^[1]  

Recovery is what gives an organization an alternative to paying, and successful ransomware data recovery depends on holding backup copies that an attack cannot alter or delete. 

What 500 IT leaders told us: Worried about AI attacks, not ready to recover 

Ahead of World Backup Day 2026, Object First commissioned a survey of 500 US IT and security leaders at companies with at least 1,000 employees to learn how they are addressing AI-powered threats. ^[1] 

The responses reveal that leaders understand the risks of AI-powered cyberattacks, but defenses have not caught up: 

• They know backups are the target. AI-powered attacks gaining access to data backups are the top concern for 79% of IT leaders, and 73% named increasing backup data security as their top defense priority.  

• They know the pressure is rising. More than half, 52%, say it is harder to keep up with threats than it was five years ago.  

• Immutability is not universal. Only 58% use immutable backup storage across all their data, which means nearly half of all environments have at least one recovery path that an attacker can destroy.  

• Even the basics are incomplete. Nearly one in three organizations (31%) do not fully follow the 3-2-1 backup rule: three copies of data, on two different media types, with one copy off-site.  

• Zero Trust has not been adopted broadly. Just 58% have adopted a Zero Trust model, and fewer still are likely to have extended it to their backups with Zero Trust Data Resilience. 

• Recovery confidence is low. Only 53% are very confident they could quickly recover from an AI-driven ransomware attack.  

 A cornerstone of data backup recovery is maintaining immutable backups, meaning that during a predefined time window, a backup cannot be altered or deleted. Care is needed here, though, because many systems that claim to offer immutable backups have hidden exceptions and loopholes.  

A solution to this is Absolute Immutability, which means that even the most privileged admin, or an attacker with access to backup storage, cannot modify or delete data. This level of ransomware backup protection can only be achieved with a storage system that is Secure-by-Design, with Zero Access to perform destructive actions. That Zero Access must also be verifiable through third-party testing. 

Backup storage with Absolute Immutability: Your last line of defense against AI-powered ransomware 

When, not if, ransomware strikes, the future of your business, reputation, and career is on the line. Object First prepares you for recovery with Absolute Immutability: even when admin credentials are compromised, nobody can alter or delete backup data under any circumstances. 

Practical implementation of Absolute Immutability requires three core principles: 

• S3 Object Storage: A fully documented, open standard with native immutability, enabling independent penetration testing and third-party verification. 

• Zero Time to Immutability: Backup data becomes immutable the moment it is written, with no gaps and no landing zones. 

• Target Storage Appliance: A dedicated appliance separates backup storage from backup software and removes the risks of DIY self-managed storage during setup, updates, and maintenance. No security expertise is required, because operational security shifts to the vendor. 

 A recent Gartner report stated that "rapid, automated remediation and resilient recovery capabilities are absolute mandates for business continuity" and recommended a layered recovery strategy that includes local immutable backups. ^[9] 

"As AI supercharges cyber threats, enhancing the speed, sophistication, and scale of attacks, organizations need backup storage that's absolutely immutable as the last line of defense against critical data loss," said David Bennett, CEO, Object First. ^[1] 

Book a demo to see how Object First makes backups ransomware-proof. 

Your AI ransomware defense checklist 

☑ Employ backups with Absolute Immutability. When, not if, a breach occurs and your business, reputation, and career are on the line, backup storage with Absolute Immutability is your ultimate ransomware defense. This means nobody, not even the most privileged administrator, can alter or delete backup data, regardless of credentials, software policies, or remote commands. 

☑ Follow the 3-2-1-1-0 rule in full. The 3-2-1-1-0 rule specifies three copies of data, on two media types, with one offsite or offline, one immutable, and zero unverified backups. It updates the older 3-2-1 model with the two requirements ransomware makes essential: one copy that an attacker cannot alter or delete, even with admin credentials, and zero backups that have not been tested and confirmed recoverable. 

☑ Apply least-privilege access and Zero Trust. Every account and service should hold only the permissions required for its specific function, because overprivileged accounts are among the most valuable assets an attacker can gain from a compromised environment. When least privilege fails, Absolute Immutability is what holds: even with a stolen administrator's password, an attacker cannot modify or delete immutable data stored in compliance mode. 

☑ Test backup restores regularly. An untested backup is an assumption, not a recovery capability. Regular testing confirms whether critical systems can be restored within the defined Recovery Time Objective (RTO) and satisfies many regulatory requirements including DORA Article 12 and NIS2 Article 21. 

☑ Monitor backup repositories and set retention beyond attacker dwell time. Retention policy changes, unusual deletion attempts, and failed authentication against the repository are early warnings worth flagging. A seven-day immutability lock provides a false sense of security when attacker dwell times routinely exceed it, so the immutability period should exceed the typical dwell time, which most security researchers set at 14 to 30 days. 

☑ Catch intruders early with decoys. A network decoy mimics a legitimate backup target to lure attackers into revealing themselves before any real data is at risk. Object First Honeypot deploys a decoy Veeam server built into the backup appliance, with simple five-click activation and email or SIEM alerts. 

Frequently asked questions 

What is the best protection against AI-powered ransomware? 

No single control stops every AI-driven attack, so the strongest ransomware protection is layered. Among those layers, backup storage with Absolute Immutability is the one that still works after prevention and detection have failed. 

What was PromptLock? 

PromptLock was a ransomware prototype that ESET identified on VirusTotal in August 2025 and described as the first known AI-powered ransomware, notable for using a language model to generate its malicious scripts at runtime rather than shipping fixed code. ^[7] Researchers at NYU Tandon School of Engineering later confirmed they had built it as an academic project called Ransomware 3.0, and it was never used against a real target. ^[8] 

What was the Hugging Face incident in 2026? 

The Hugging Face incident was a July 2026 breach in which autonomous AI agents broke into the infrastructure of Hugging Face, a widely used platform for sharing AI models and datasets. [10] OpenAI later confirmed the agents were its own models, running an internal cyber-capability evaluation with reduced safeguards. ^[11] It was not a ransomware attack, and the database the agent reached was read but not modified, but it showed how an AI agent can use stolen passwords and keys to move through a live environment. ^[10] 

Can AI ransomware rewrite itself to evade detection? 

Yes. AI-powered ransomware can generate or mutate its own code so that each version looks different, a technique known as polymorphism, which leaves signature-based tools with no stable pattern to match. ^[5] 

Can AI-powered ransomware get past immutable backups? 

That depends on how  immutability is enforced: policy-based rules can be changed by anyone with admin access, including an attacker holding stolen credentials. Absolute Immutability, using S3 Object Lock in compliance mode with Zero Access to destructive actions, holds at the storage layer regardless of credentials, so backup data cannot be altered or deleted for the defined retention period. 

How do I recover from an AI-powered ransomware attack? 

Isolate the affected systems, identify a clean restore point that predates the initial compromise rather than the visible attack, restore from an absolutely immutable backup, and verify the restored environment before reconnecting it. Our report on how to recover from AI-powered ransomware covers the full sequence.

References 

[1] Object First. "Object First Survey: 89% of IT Leaders Fear AI-Powered Cyberattacks Will Cost Them Their Data." 2026. https://objectfirst.com/newsroom/press-releases/object-first-survey-89-percent-of-it-leaders-fear-ai-powered-cyberattacks-will-cost-them-their-data/ 

[2] Sysdig. "JADEPUFFER: Agentic ransomware for automated database extortion." 2026. https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion 

[3] Anthropic. "Threat Intelligence Report." August 2025. https://www.anthropic.com/news/detecting-countering-misuse-aug-2025 

[4] Google Threat Intelligence Group. "GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools." November 2025. https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools 

[5] Object First. "Invisible Threats: How AI Is Rewriting the Rules of Data Protection." 2026. https://objectfirst.com/ai-data-protection/ 

[6] Omdia. "Recovery without Compromise: The Data-Backed Case for Backup Storage with Absolute Immutability." Commissioned by Object First, 2026. 

[7] ESET. "ESET discovers PromptLock, the first AI-powered ransomware." 2025. https://www.eset.com/us/about/newsroom/research/eset-discovers-promptlock-the-first-ai-powered-ransomware/ 

[8] NYU Tandon School of Engineering. "AI-Powered Ransomware That Sparked Concern Was NYU's Work." 2025. https://engineering.nyu.edu/news/ai-powered-ransomware-sparked-concern-was-nyus-work 

[9] Gartner. "The Claude Mythos Infrastructure Cybersecurity Threat Remediation Playbook." G00856172, 1 June 2026, Tim Zimmerman, Andrew Lerner, John Watts, Charlie Winckless, Dhivya Poole, Chuck Lawton. 

[10] Hugging Face. "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident." July 2026. https://huggingface.co/blog/agent-intrusion-technical-timeline 

[11] OpenAI. "OpenAI and Hugging Face partner to address security incident during model evaluation." July 2026. https://openai.com/index/hugging-face-model-evaluation-security-incident/