Cybersecurity News
Automated Ransomware Attacks Cost as Little as $4, Exposed Server Reveals
Source: Cybernews
Publication Date: September 2nd, 2026.
Full Article: https://cybernews.com/security/exposed-ransomware-server-reveals-automated-4-dollar-cyberattacks/
On July 22nd, 2026, researchers at Cybernews discovered an exposed server containing 3.1 terabytes of data stolen from over 30 companies. The server belonged to an affiliate of “The Gentlemen,” a Russian-speaking ransomware gang that has claimed roughly 700 victims in the past year.
However, the most noteworthy finding was that the group’s attacks originated entirely from that one server, and that the efforts were driven entirely by an AI agent, the outlet explained in a recent article.
Reliance on Open-Source AI
The affiliate used an open-source AI harness called Hermes, powered by the DeepSeek-V4-Pro model, to compromise vulnerable GitLab instances, exfiltrate data, and draft ransom demands. Aras Nazarovas, the Cybernews security researcher who found the server, said the attacker supplied little more than a target URL and stolen credentials before the AI agent handled reconnaissance, exploitation, and extortion on its own.
The token costs for each attack ran between $0.40 and $4, a fraction of what manual intrusion work would require.
Bypassing Safeguards with “Training Exercises”
The group bypassed AI safety guardrails by disguising real attacks as a fictional “Capture the Flag” training exercise. Known commonly as an AI “jailbreak,” this tricked the model into treating live victims as practice targets, which technically didn’t violate its internal guidelines and training.
Recommendations from Cybernews
Cybernews recommends that companies rotate exposed credentials, restrict GitLab access to trusted networks, and monitor for unusual repository activity such as bulk cloning or unauthorized CI/CD tool deployment.
Ransomware operators no longer need large teams or great technical skill to run profitable, simultaneous campaigns against dozens of targets. They can use AI agents, open-source models, and other automated tools to spin up endless attacks.
Enterprise AI at Risk as 73% of Organizations Aren’t “Fully Ready” for a “Significant” Cyberattack
Source: The Hacker News
Publication Date: September 2, 2026
Full Article: https://thehackernews.com/2026/09/how-to-secure-enterprise-ai-from.html
New research by Sygnia, published in the “2026 CISO Survey Report,” revealed that most companies are adopting AI faster than they are securing it. According to an article by The Hacker News, the survey of 600 senior IT and security leaders found that nearly a third of organizations already use AI extensively in threat detection and incident response, with 63% expecting it to be fully embedded by 2027.
Despite that pace, 73% of respondents said their organization would not be fully prepared if a major cyberattack happened tomorrow.
Poor Governance is Key Driver
The article traces the disconnect to weak governance.
Only 38% of organizations reported having a comprehensive AI policy, even as employees adopt AI tools through SaaS plugins, vendor products, and unsanctioned workarounds. Startlingly, 67% of executives believe their companies have already suffered a breach tied to unapproved AI use.
Attackers, meanwhile, are using AI to execute familiar tactics faster and at greater scale, exploiting the same enterprise weaknesses with less effort than before.
A Different Approach to AI Cybersecurity
The article argues that organizations should approach AI security as a constantly evolving challenge and not simply assume they can check it off with the usual security protocols. It calls for organizations to define ownership over each AI use case, limit system permissions to what a task actually requires, and update incident response plans to account for scenarios like prompt injection and agent compromise.
Nearly 90% of security leaders cited limited executive involvement in incident readiness as a barrier. This underscores the need for board-level accountability alongside technical controls.
Offensive Cybersecurity Investments Surge in Response to AI Threats
Source: DarkReading
Publication Date: August 28, 2026
Full Article: https://www.darkreading.com/cybersecurity-operations/offensive-security-investments-surge-ai-threats-increase
A recent interview published by DarkReading explores why companies are pouring more money into offensive cybersecurity practices like penetration testing. Theresa Lanowitz, principal analyst at global technology research and advisory firm Omdia, discussed research showing that 88% of organizations plan to increase their offensive security budgets in 2026, with 23% expecting a significant jump.
AI-Powered Attacks Pose Increasing Threat
Lanowitz told DarkReading that there are three main factors influencing these decisions:
- AI attacks are fueling the need for offensive cybersecurity strategies.
- Traditional cybersecurity practices are “no longer working.”
- Overall investment in AI is increasing as well.
“The attacks are moving faster, the attackers are moving faster, [and] the vulnerabilities are being exploited, Lanowitz said. “Speed is now the biggest concern, and so along with that, this idea of continuous visibility comes into play.”
AI-powered automated attacks were the single biggest factor driving that spending, cited by 32% of respondents.
Lanoqitz pointed specifically to agentic AI, systems that can act autonomously, as a tool cybersecurity teams can use for penetration testing, red teaming, and continuous visibility. This is a change compared to previous strategies, which depended on periodic, point-in-time assessments.
Notably, 42% of survey respondents named autonomous AI security agents as the technology most likely to reshape offensive security strategy this year.
A Warning About Misconfigured AI Tools
The research also identified a certain amount of risk within AI-driven cybersecurity. The same automation that helps defenders find and fix weaknesses can introduce new risks if the AI tools themselves are misconfigured or targeted by adversaries.
Lanowitz recommended feeding offensive security findings directly into defensive operations and engineering workflows instead of treating red team results as separate functions. For organizations without deep in-house expertise, that shift means offensive testing now requires the same oversight and vetting once reserved for defensive tools.
Cybersecurity Tips
Tech, Security, and AI Experts Share Why Companies Should Teach Limits to AI Agents
Source: CIO Magazine
Publication Date: September 2nd, 2026
Full Article: https://www.cio.com/article/4208063/ai-agents-need-to-learn-when-enough-is-enough.html
A recent article in CIO Magazine makes the case that AI agents need to learn when to stop, not just how to act.
The author is Pat Brans, an affiliated professor at Grenoble École de Management and the author of “Master the Moment: Fifty CEOs Teach You the Secrets of Time Management.” He has held senior technology positions at Computer Sciences Corporation, HP, and Sybase, giving him a practitioner’s view of enterprise systems.
Brans also quotes other experts in the article, including technology leaders and executives.
AI Systems Will Always Act, Even Without Context or Direction
Brans draws on an interview with Allan Dabre, a technology compliance leader who has spent 14+ years transforming enterprise risk, controls, and governance for some of the world’s largest Fortune 500 companies.
Dabre argues that restraint has to be designed into AI systems deliberately. Dabre points out that AI is built to be helpful, so a model will often produce an answer or take action even when it lacks enough context to do so safely.
Interpreting Dabre’s claims, Brans distinguishes between confidence and authority:
“An AI agent may be 99% confident a record should be updated, a refund should be approved, or a legacy database can be decommissioned. But that doesn’t mean the agent has the authority to act,” he says.
“Confidence is about the probability the system believes it’s right. Authority is about whether the organization has delegated that action to the system in the first place.”
The “Least Agency” Principle
The article also features Matt Graney, chief product officer at Celigo, who describes a cybersecurity principle he calls “least agency.” This involves giving an agent only the minimum autonomy needed to complete a task, rather than letting it own an entire workflow.
Graney recommends placing guardrails outside the model itself, so the same system making a decision is not also the one judging whether that decision is acceptable.
“The smaller you make that surface area, the better,” Graney says.
Keeping Humans Accountable
A third expert referenced in the article, Matt Quinn, CTO at CarGurus, describes how his team built human approval steps into agent workflows for consequential actions. They accomplished this while an agent now handles about 70% of incoming dealer cases without human involvement.
“Quinn says the human remains ultimately accountable for the work,” write Brans. “That principle is especially important in engineering, where agents may help write code or fix bugs.”
Brans’s central recommendation for CIOs is to divide ownership clearly before deployment:
- The business defines the outcome.
- Technology builds the agent.
- Risk and compliance set the boundaries.
- Governance monitors whether the system still behaves as intended.
Once the system is live, these steps can help ensure AI agents stay on task and avoid taking action where it is not wanted.
