Bitdefender documents a 3AM ransomware attack on UK schools run partly by an AI agentic loop

Why it matters

Bitdefender calls it the first case of its kind it has documented in Europe: a human operator set goals while something resembling an agentic loop generated, ran and retried commands, including a Veeam backup call written with the wrong port and login method, a mistake typical of a model writing from memory. Dark Reading notes the researchers stopped short of claiming full automation and that the intrusion otherwise followed a familiar ransomware playbook. Bitdefender expects such hybrid attacks to become more common in 2027. Watch for confirmation from other responders and from UK authorities.