Developers release free RAID-AI ransomware Framework for AI systems

Developers Behnaz Karimi and Yuvaraj Govindarajulu developed RAID-AI, a free ransomware resilience framework for AI systems, over the past two years and planned to introduce it at the ISC2 Security Congress in Denver, Colorado, between Oct. 26 and 28.

RAID-AI assesses ransomware resilience for AI systems whether or not an attacker uses AI. The framework is offered free online to anyone. Teams evaluate their controls by hand rather than connecting to or scanning live systems, and users select maturity levels for each control on a scale from zero to five.

Completing the assessment does not require connecting internal systems or uploading company documents. The tool is not an automated audit; its results rely on users’ own evaluations, and it does not independently verify security posture. The developers published comprehensive documentation explaining how they built the tool and how the tool calculates maturity levels and scores.

The framework operates within a browser and keeps state on the local machine, meaning no data leaves the user’s computer. The approach makes it safe for air-gapped environments (systems isolated from outside networks) and sensitive organizational data.

RAID-AI maps each control to five frameworks: NIST Cybersecurity Framework 2.0, CISA Cybersecurity Performance Goals 2.0, MITRE ATT&CK, MITRE ATLAS and NIST Adversarial ML. The research site also lists NIST AI 100-2, OWASP LLM Top 10 2025 Edition, NIST AI Risk Management Framework and CISA CPG 2.0 as references for how ransomware targets AI systems. The tool lets users chart adversarial attacks using MITRE ATT&CK, MITRE ATLAS and NIST Adversarial.

The controls divide into general and AI-specific groups, with tiers including basic, advanced and high. Recovery, training and sensitive-data protection fall under the general controls. Data, tools and runtime make up the AI-specific areas. The framework scores more than 90 controls across four tiers: Basic, Advanced, High and AI-Specific.

RAID-AI coverage includes model artifact backups, GPU host hardening, prompt-injection defenses, agentic-tool security and AI supply-chain integrity. The framework covers general cybersecurity measures and risks specific to AI models, data and supporting infrastructure.

CISOs, cybersecurity officers and security engineers are the intended users of the web console. Karimi advises teams to run the assessment as a workshop involving security managers, engineers and AI-security specialists. Dashboards display maturity views and framework mappings, and users can download PDF reports that flag weaknesses.

According to Karimi, the dashboard gives senior leaders a high-level overview while technical teams discuss the underlying controls in detail. The project site describes a live executive dashboard featuring a NIST CSF radar, with exports available as PDF executive summaries and JSON or CSV files for governance, risk and compliance (GRC) integration. Planned additions include videos and blueprints to help security engineers apply individual controls.

The project site says developers built the tool to close a gap because traditional ransomware assessments overlook the AI-specific attack surface. The research site describes AI systems as concentrated high-value assets, noting that model weights took months and millions to train and that inference infrastructure supports business operations.

The site also notes minimal backup coverage, poorly defined recovery procedures and agentic components that carry elevated privileges with minimal monitoring. Both developers co-lead the Open Worldwide Application Security Project’s AI Bill of Materials effort. Karimi could not attend the ISC2 Security Congress because of visa issues.

Figures for Q1 2026 show 1,811 ransomware victims, marking a 126 percent increase over the previous year, as threat actors focus on organizations with major AI investments. The research site describes Q1 2026 as the highest quarterly ransomware victim total on record, citing reduced operator skill and AI-assisted campaign deployment as drivers.

The quarterly figures also include a record single month fueled by mass exploitation campaigns aimed at organizations with heavy AI infrastructure investments. Healthcare led ransomware targeting in Q1 2026, the site says, because of high-value AI and patient data, legacy infrastructure and low tolerance for ransomware.

Prompt injection serves as an initial access vector: malicious instructions run by AI agents can deliver ransomware payloads without traditional phishing. Agent-triggered file encryption carries a critical rating because compromised agentic systems can enumerate, exfiltrate and encrypt AI model artifacts, training data and vector stores.

AI supply chain compromise also carries a critical rating because malicious packages and backdoored model weights create persistent footholds for ransomware staging inside AI pipelines. The research site rates RAG store poisoning, which targets retrieval-augmented generation systems, high because attackers poison vector databases to manipulate agent behavior, including disabling backups or staging payloads.

Persistent memory manipulation receives a high rating because attacker-controlled context that persists across sessions allows long-term influence without re-exploitation. Multi-agent lateral movement receives a medium rating because a compromised orchestrator sends malicious sub-tasks to worker agents, enabling movement without touching endpoints.

RAID-AI Research Notes from 2025 describe AI agents as trusted, high-privilege insiders that can access files, APIs and backups. CrowdStrike intelligence indicates agentic intrusions rose threefold during the latter half of 2026.

INC and The Gentlemen are among the ransomware cartels deploying ransomware AI agents through the Autonomous Red Team Kill Chain Framework known as Phantom. Phantom, an Autonomous Red Team Kill Chain Framework, automates the entire cyber attack lifecycle from initial access through data exfiltration and encryption.

Within Phantom, AI agents receive a goal and use machine learning models to analyze environments, spot vulnerabilities and run commands on their own. Agentic intrusions primarily target critical infrastructure, industrial, manufacturing, energy and healthcare sectors.

Autonomous ransomware AI agents exploit edge devices such as internet-of-things sensors, smart industrial controls, building management systems and network routers. AI agents rely on AI-managed knowledge bases that track victim information, stolen credentials, network maps and effective attack methodologies.

AI agents can scan open-source repositories, find vulnerable dependencies and inject malicious code into development pipelines to compromise software supply chains. The Tech Edvocate says disrupting an energy grid or hospital carries far more severe consequences than a personal data breach, creating immense pressure to pay. Ransomware cartels feed new attack findings into AI-managed knowledge bases covering victims, credentials, network maps and methods, making the system smarter over time.

OSINTSights says RAID-AI surfaces gaps in traditional IT hygiene and the unusual risks introduced by AI models and their supporting infrastructure. The summary emphasizes the framework’s dual focus on conventional safeguards and AI-specific dangers.

The World Economic Forum’s survey found 45 percent of respondents place ransomware among their top cyber risk concerns. Veeam’s 2024 ransomware trends report found that 96 percent of ransomware attacks seek to corrupt or delete backup repositories early in an attack.

AI training data faces unique vulnerability because it carries high value, has limited replacements, is widely distributed and presents new technical attack paths. Attackers may target AI models through extraction and tampering, model inputs and outputs through prompt injection and evasion, and training data through data poisoning, unauthorized collection, inversion and reconstruction.

Agent-based AI creates an entry point because agents often receive broader permissions than required, giving hijacked agents a direct path for ransomware to spread. Training data for AI systems moves through object storage, shared file systems, machine learning operations tools, data warehouses, feature stores and internal backups.

Model outputs can sometimes reveal training data, and weak controls expose pipelines to poisoning as training and deployment reuse data. Legacy backup tools may overlook AI components entirely, and shared credentials between backup and primary systems let attackers reach both with minimal effort. An enterprise AI ransomware readiness checklist includes regular tests to confirm that datasets, models and pipelines can be rebuilt from backups.

Karimi told Infosecurity that ransomware attacks targeting AI systems are slowly occurring. She cited an April 2025 report from Zoran Mitrovic, head of engineering at Kintra Health, on ransomware actors’ use of data poisoning techniques. Karimi also cited an alleged June 2026 cyber attack on Novo Nordisk in which hackers claimed to have stolen AI models.

RAID-AI Research Notes from 2025 state that “The ransomware risk isn’t that AI attacks you autonomously.” Karimi hopes to build a similar tool for ransomware threats against agentic AI systems.