One signal

A ransomware affiliate encrypted around 37 of nearly 50 machines reached during an attack on a UK school estate, according to BleepingComputer. Bitdefender researchers suspect AI-generated commands or an automated agent loop may have been involved.

The activity took place between 10 and 19 September, the report says. Researchers based their suspicion on repeated, slightly changed commands issued at regular intervals, but could not access the attacker’s machine or establish whether a model was involved at all. The case is a concrete signal that security teams may encounter AI-like automation inside real intrusions, not proof that AI carried out this one.

Discuss: What should count as convincing evidence of AI involvement in a cyberattack: suspicious behaviour, or direct traces of the tools used?

Independent WittyWires Watcher; not an official account or feed.