Security leaders have had good reason to worry about ransomware since it emerged as a major threat in the mid-2000s. Unfortunately, AI has introduced a further unsettling possibility, in which an organization could find its own systems manipulated into acting as a proxy for attacks on somebody else.
Welcome to the world of Reverse Ransomware. This is a threat model in which a threat actor co-opts an organization’s AI agent and uses its existing access to attack and plant ransomware to another organization.
Recent incidents show why this possibility deserves attention. OpenAI revealed that models involved in cybersecurity evaluations had escaped intended isolation and infiltrated third-party systems, including Hugging Face.
That introduces an important question for security leaders: what happens when your AI systems become the attacker?
Attack anatomy
With traditional ransomware, a threat actor breaches an organization and attempts to conceal where they came from while establishing access, disrupting systems, stealing data or encrypting assets before demanding payment.
‘Reverse ransomware’ presents a different threat model. An organization’s AI, either acting unexpectedly on its own or after being manipulated or co-opted by a threat actor, uses the organization’s environment, systems, resources and access to attack somebody else.
That creates two victims. For example, imagine a bank that has deployed an AI agent to support a legitimate business process may provide it with access to customer data or services used to interact with other organizations. If a threat actor manipulates the agent and directs it towards a retailer that deals with the bank, that retailer may initially see harmful activity originating from the bank’s environment, even though the bank is also a victim.
The bank could face difficult (and costly) questions about how its AI was manipulated and whether it could have detected the activity sooner and what is its responsibility and liability. Depending on the circumstances and jurisdiction, there could also be legal, regulatory, contractual and reputational consequences.
A new form of double extortion
From the threat actor perspective, they now have a new double extortion option to pursue. They will still demand payment from the external organization whose systems have been disrupted and may also approach the one whose AI was compromised. The second demand could be based on a threat to expose the fact that its AI was used in an attack on another business.
This is why reverse ransomware is more than simply ransomware delivered through a new piece of technology. An organization could find itself simultaneously investigating a compromise, containing an AI system, and accounting for harm originating from its own environment.
Organizations cannot treat a reverse ransomware incident as a conventional breach.
The AI under investigation may access internal communications and shared information. Responders, therefore, need to understand what it could see and influence. If a threat actor has also compromised the environment, those same systems may no longer provide a trustworthy foundation for the investigation.
That changes the fundamental incident-response question to “Where can we safely command the response?”
No room for compromise
From a cybersecurity and governance perspective, an organization cannot credibly investigate a potentially compromised or manipulated AI using systems that AI or an attacker exploiting it may still be able to access or influence. Doing so risks undermining the integrity of the response and contaminating evidence. From there, it’s harder to establish what happened, contain the damage and prevent a recurrence.
Organizations, therefore, need a secure, out-of-band incident environment that is isolated from the systems under investigation and ready before an incident occurs, where the two affected parties can coordinate the response. An AI incident can quickly involve security, IT, legal, privacy, compliance, communications, senior executives and external specialists. They need a trusted place to establish what the AI did, whether it was manipulated, what systems and data were affected, and what harm may have occurred inside and outside the organization.
That environment should contain tested playbooks tailored to the organization’s AI estate, clear human decision-making authority and established routes for bringing in external providers when required.
Organizations should develop a tabletop scenario built around this specific threat, i.e. an AI agent has been compromised and used to harm another organization. The exercise should examine whether teams can stop the agent and isolate affected systems. It should also establish how evidence will be preserved and which external specialists need to be involved and, of course, the effect on business continuity.
Moreover, if an AI incident causes harm outside the organization, assurances will not be enough. The organization will need evidence: what happened, what the AI did, how the incident was contained, what impact occurred and what was done to prevent it happening again.
Reverse ransomware is an emerging threat model, but the resilience requirement is already clear. As organizations give AI agents greater access and autonomy, they must prepare for the possibility that those systems will not always behave as intended. Human command, a trusted out-of-band environment and the ability to investigate, respond and recover need to be designed in before the incident occurs.
