When your AI helper has admin rights: the new ransomware fast lane

Key points

• Acronis warned in November 2025 that enterprise AI assistants and agents can speed up ransomware attacks when they hold too many permissions.
• The core risk is identity: an AI account that can read every file and run every script becomes a master key if hackers steal its login.
• Acronis recommends least-privilege access, meaning each AI tool only gets the bare minimum it needs to do its job.
• Governance controls, such as logging what the AI does and who asked it to do it, are the difference between a small incident and a full outage.
• The guidance lands as most large firms are rolling out Microsoft Copilot, Google Gemini and custom agents built on OpenAI and Anthropic models.

Enterprise AI is being handed the keys to the building. That is the uncomfortable message from a new Acronis writeup, first surfaced by BleepingComputer, on how generative AI, meaning software that can write, summarise and take actions on a user's behalf, is quietly making ransomware attacks worse.

Ransomware is malicious software that scrambles a company's files and demands payment for the key. It has been the defining business crime of the last five years. What is changing is how fast attackers can move once they are inside.

The failure mode here is boringly familiar. It is identity.

When a company plugs an AI assistant into its systems, someone has to decide what that assistant is allowed to touch. In practice, harried platform teams give it far more access than it needs. Read every SharePoint site. Query every database. Trigger every workflow. It is easier than working out the exact permissions, and nobody wants to be the person who broke the demo.

Then the AI's login gets stolen, or an employee who can talk to the AI gets phished, meaning tricked by a fake email into handing over their password. Suddenly the criminals are not rummaging around one laptop. They are asking a helpful robot with domain-wide privileges to fetch every finance document and every backup location.

What does this actually look like in an attack?

It looks like a normal Tuesday, right up until it does not. An attacker gets a valid session token, the small file that proves you have logged in, for a single employee. In an old-fashioned intrusion they would spend days moving sideways through the network. With an AI agent sitting in the middle, they can just ask.

Acronis flags three routes it sees repeatedly. AI accounts with standing admin rights. Agents wired into cloud storage such as Amazon S3 buckets or Azure Blob containers with no scoping. And retrieval systems that pull sensitive files into prompts without checking who is on the other end.

One thing the post-mortem will say, every time, is that nobody was watching what the AI did on behalf of users.

What should companies actually do?

Acronis's advice is not exotic. It is the same identity hygiene that cloud security people have been begging for since AWS IAM shipped. Give each AI tool its own identity. Scope that identity to one job. Rotate its credentials. Log every action it takes, tied to the human who prompted it.

A few practical moves worth calling out:

• Treat AI agents as service accounts, not as employees. They should not inherit a human's full permissions.
• Use just-in-time access, where elevated rights are granted for a few minutes and then revoked, for anything that touches production data.
• Put a data loss prevention layer in front of the model so it cannot quietly hoover up regulated files.
• Turn on the audit logs your cloud provider already ships, and actually read them.

None of this is new. It is the same conversation the industry had about OAuth apps in Google Workspace five years ago, and about Kubernetes service accounts three years ago. The pattern rhymes.

For ordinary customers and staff there is nothing dramatic to do today. If your employer is rolling out an internal AI assistant, it is fair to ask whether it can see your HR file, and who approved that.

Operational takeaway: if your AI agent's blast radius is the whole tenant, you do not have an AI problem, you have an IAM problem.