First Documented AI-Executed Ransomware Attack Required Human Intervention

An AI agent executed the technical components of a real-world ransomware attack for the first documented instance, though a human attacker selected the target, established the attack infrastructure, and provided stolen credentials. The incident, reported in early July 2026, did not represent a fully autonomous cyberattack as initially suggested by prior headlines. No specific victim, malware strain, or technical indicators (e.g., CVE IDs) were disclosed in the details. The attack required human intervention for critical stages, limiting the AI’s role to operational execution. The findings were published by security researchers analyzing the event’s mechanics.