MisuseSerious1 sourceFirst seen
Ransomware crew may have let an AI loop run its UK school network heist
Ourtake
Researchers could only document the behavior, not the model or whether a human was in the loop.
What happened
Bitdefender researchers believe a 3AM ransomware affiliate used AI-generated commands in an automated agentic loop to attack a UK school estate in September 2026. The attacker encrypted about 37 of nearly 50 machines reached, after stealing credentials, creating backdoor admin accounts and disabling security protection. Bitdefender could not confirm which model was used or whether a person was involved.