A survey of ransomware victims reports AI on the attacker's side in 84% of cases, and the victim's own AI exploited in 44%
Semperis's 2026 Ransomware Risk Report, read here in CBS News's October 14 account, surveyed about 1,200 IT and security professionals across nine countries and eight industry sectors at organisations hit by ransomware. Per that account, 84% of those surveyed said AI was used on the attackers' side and 44% said the attackers exploited the organisation's own AI agents or systems; 87% said the attack targeted identity systems or the infrastructure controlling network access, 69% were hit more than once in the previous year, and 59% paid a ransom at least once. Chris Inglis, the first US National Cyber Director and a Semperis strategic advisor, is quoted saying “I think we're already seeing autonomous attacks” and that AI “is an inflection point in their capacities to hold the same things at risk”, and Semperis's Tomer Bar that “We're starting to see more attacks with more rapid development, and attribution of these attacks will be more difficult for law enforcement.” These are respondents' own characterisations of attacks against them, not a count of attacks, and the account's own headline overstates them as a share of all ransomware attacks. semperis.com would not open to this run, and other accounts of the same report give its physical- and psychological-threat figure three different ways, so none is carried here.
The National Cyber Director's office and Texas launch a six-month cyber pilot for water utilities
Project Watershed 250 is a six-month pilot run by the Office of the National Cyber Director with Texas Cyber Command, offering water and wastewater utilities red-team testing of current defenses, system hardening with private-sector tools, and AI tooling for utility cyber defenders. Twelve companies are named: Parsons, Microsoft, Fortinet, Google Cloud, Palo Alto Networks, Amazon Web Services, Reflection AI, Cloudflare, Zscaler, Forescout, Abnormal AI and Dragos. No number of participating utilities and no dollar figure is stated.
National Cyber Director Cairncross backs global adoption of US open-source AI and rejects a formal AI regulatory regime
Speaking at Black Hat in Las Vegas, National Cyber Director Sean Cairncross said the administration wants U.S.-built open-source AI to become the preferential technology of choice globally, and argued a regulatory regime 'would be obsolete 48 hours after' completing its process, favouring flexible government-industry information sharing instead. Nextgov reported that on the same day the White House told major developers that open-weight models would not be included in its new voluntary government testing program.
Five Senate Democrats demand a published framework for restricting access to US AI models
Sens. Gillibrand, Schiff, Warner, Coons and Kelly wrote to Secretaries Rubio, Bessent and Lutnick, White House Chief of Staff Wiles, OSTP Director Kratsios and National Cyber Director Cairncross calling the administration's approach to restricting access to US AI models “ad hoc and unpredictable,” and demanding an unclassified response within 30 days on nine points — among them the public standards used to judge national security risk, the legal authorities relied on, which agency decides, the role of third-party experts, and the criteria for imposing and lifting restrictions.