- Researchers behind the free RAID-AI framework argue that ransomware actors can abuse AI agents that already hold access to files, APIs and backups.
- The tool is a self-assessment. It does not scan systems or verify answers, so its score is only as honest as the team's input.
- Inventory which agents can touch backups, test restores of model files and vector stores, and run the assessment as a cross-team workshop.
Most talk about AI and ransomware pictures a machine that attacks on its own. A new framework points somewhere less dramatic. Its authors say the larger problem is an AI agent that already has access, and that someone else can steer.
The idea: an agent with access is a target in its own right
Behnaz Karimi and Yuvaraj Govindarajulu lead the OWASP AI Bill of Materials initiative. They have released RAID-AI, a free tool for judging how well an organisation could withstand ransomware aimed at its AI systems. Infosecurity Magazine reported on it on October 30.
Karimi told the magazine that the framework covers attacks on AI systems whether or not the attacker uses AI. That is narrower than the picture of AI-powered ransomware many readers carry in their heads, and it is more practical.
Their research site frames the risk this way. An agent holds delegated authority over files, APIs and systems. Ransomware actors, the site says, can exploit that authority and use the agent to deliver their work.
The lesson here is simple. A firewall is built to keep strangers out. An agent is already inside, and it acts on the instructions it reads.
How the attack works, according to the researchers
The site describes five phases. First, attackers look for AI assets. These include model registries, inference endpoints (servers that run a model), GPU clusters and vector databases. A vector database holds the searchable knowledge an AI system draws on.
Next comes initial access. The site names prompt injection, supply chain compromise and stolen credentials for AI service accounts. Prompt injection means hiding instructions in a document, email or web page. The agent reads them and may follow them.
The researchers say such instructions can run with the user's full permissions. That would deliver a payload without a phishing email. They also describe poisoned retrieval stores that push an agent toward disabling backups or leaking credentials.
Then comes persistence. The site says AI systems with memory can be made to keep attacker-supplied context across sessions. In multi-agent setups, a compromised orchestrator can hand harmful tasks to worker agents. That moves the attack sideways without touching a laptop or server.
The final phases are theft and encryption. The site lists model weights, training data and system prompts as targets. It says demands can include threats to publish proprietary model data.
What the evidence shows so far
The site states that Q1 2026 data shows 1,811 ransomware victims, a 126% rise on the year before. The text we reviewed does not name the dataset. It also does not say how much of the rise involves AI systems. Read the figures as the authors' background, not as proof of an AI-specific wave.
Karimi gave Infosecurity Magazine two examples. One was an April 2025 report by Kintra Health's head of engineering on ransomware actors using data poisoning. The other was an alleged June 2026 attack on Novo Nordisk. There, hackers claimed to have stolen AI models. That is an allegation as reported.
As reported, neither example describes an agent being manipulated into attacking its own organisation. The agent-abuse paths above are the researchers' threat model, not something these two cases demonstrate.
Karimi was measured about the trend. She said such attacks are "slowly" appearing.
What the tool is, and what it is not
RAID-AI runs in a web browser. Teams rate more than 90 controls on a scale from zero to five. The controls sit in four tiers: basic, advanced, high and AI-specific.
Each control links to five reference frameworks. Two are voluntary US frameworks, from NIST and CISA: CSF 2.0 and CPG 2.0. The other three help teams describe attacker behaviour. Two come from MITRE, called ATT&CK and ATLAS. The third is NIST's work on adversarial machine learning.
The site says no data leaves the user's machine. Infosecurity Magazine adds that no company documents are uploaded. Results appear in a dashboard and a PDF report.
That design has a limit. Infosecurity Magazine notes that RAID-AI is not an automated audit. It does not scan systems or check any answer. The score reflects how honest and complete the team's input was.
Karimi suggested running it in workshops with security managers, engineers and AI-security specialists. The advice fits the problem. In our view, agent risk tends to sit between teams, and one team scoring alone may miss it.
Questions to put to your team
Start with the agents already running. Which can read files, call APIs or reach backups? What permissions does each hold? Who reviews what it does?
Ask whether model files, vector stores and system prompts are backed up. Ask whether anyone has tested a restore. Ask whether the backup store sits out of reach of the agents it protects.
Ask what an agent does with instructions found inside a document or web page. Ask who vets the packages and models entering your AI toolchain.
Then use RAID-AI to structure a workshop, and treat the score as a prompt for discussion. An agent with broad access deserves the same scrutiny as a new employee with the same access.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Behnaz Karimi and Yuvaraj Govindarajulu (OWASP AIBOM initiative).
