October 15, 2026
The report says AI was involved in 84% of ransomware attacks. That number is being repeated everywhere today. It is not the important one.
The important number is 44%.
Forty-four percent of victims reported that the attack exploited their own AI agents. Not an attacker's AI. Not a malicious model. Their own systems, running with their own credentials, doing what they were built to do—except the agent had been manipulated, or the credentials had been harvested, or the authority had been misrepresented.
The attack did not come from outside. It came from inside the trust boundary.
What 44% Actually Means
When an organization deploys an AI agent, it grants that agent authority. The authority to read records. To call APIs. To move data. To execute actions. The agent acts under delegated permissions, using credentials the organization issued, performing tasks the organization defined.
Every one of those actions is a decision. The agent decides what to read, what to call, what to execute. In most organizations, no one can prove what the agent decided. No one can verify the authority that permitted it. No one can replay the sequence.
The 44% figure is the consequence. When attackers compromise an agent, they inherit its authority. When they manipulate its inputs, they manipulate its decisions. When they harvest its credentials, they act as the agent.
And when the breach is discovered, there is nothing to examine. There is no record of the decision. There is no proof of the authority. There is no replay of the sequence.
The investigation starts from zero.
What the Report Actually Says
The report does not say AI caused the attacks. It says AI was involved. The distinction matters because the industry is responding to the wrong half.
The offensive use of AI—writing code, scanning for weaknesses, automating intrusion—is a threat problem. It belongs to the defenders. It is not solved by a standard.
The exploitation of the victim's own agents is a proof problem. The agent took an action. Was it authorized? Was the authority valid? Was the decision the one the organization intended? Was the execution the one the decision permitted?
Those are questions of evidence. They have answers. The answers require a record that does not currently exist in most organizations.
Why Attribution Fails
The report notes that attribution of these attacks will be more difficult for law enforcement. That is an understatement. Attribution is not difficult. It is impossible without a record.
Consider what an investigator needs to establish:
| Question | What It Requires |
|---|---|
| Did the agent take the action? | A deterministic record of the action |
| Was the action authorized? | A verified authority chain |
| Was the input authentic? | Evidence provenance |
| Was the execution correct? | A replayable execution record |
| Was the agent manipulated? | A comparison of intended vs. observed behavior |
None of these can be answered from logs. Logs record that something happened. They do not record why. They do not bind the decision to a rule. They do not chain the authority. They do not prove the input was real.
An investigation without these records is not an investigation. It is a reconstruction from memory.
The Layer That Was Missing
Every organization that deployed an AI agent made an implicit assumption: that the agent's actions would be self-evident. That if something went wrong, the system would show what happened.
It does not. The agent is a decision-maker. Its decisions are not visible unless someone built the layer that records them.
That layer has four components:
Verification. The agent's inputs must be proven authentic. Not asserted. Not assumed. Proven. Every credential, every approval, every signal must come with a proof of provenance.
Authorization. The agent's authority must be bound to the decision. Not just "the agent had permission." The specific authority, at the specific moment, under the specific policy.
Execution proof. The action taken must be proven to match the action authorized. Not "the agent did something." The agent did this thing, and this thing was permitted.
Forensic replay. Given the same inputs and the same authority, the decision and execution must be reproducible. Any party must be able to verify the record independently.
Four layers. One chain. The record that makes attribution possible.
What Just Happened in the Market
In the last week, three vendors launched products that address pieces of this layer.
One launched a "deterministic execution framework." One launched "replayable decision trails." One launched a "cryptographically verifiable audit trail."
Each is a fragment. None is the layer.
A deterministic execution framework that cannot prove the input was authentic is a framework for making assumptions. A replayable decision trail that cannot bind the decision to an authority is a trail without a destination. An audit trail that cannot prove the execution matched the authorization is a record of an action, not a proof of a decision.
The fragments are converging. The standard they are converging toward was published in August.
The Standard Already Exists
The Decision Contract defines five conditions for a compliant record of an automated decision: determinism, replayability, tamper-evidence, framework mapping, and rationale.
Every condition maps directly to the 44% problem.
| Condition | What It Proves |
|---|---|
| Determinism | The decision is reproducible |
| Replayability | The record can be verified by any party |
| Tamper-Evidence | The record cannot be altered |
| Framework Mapping | The decision is bound to the rule that governed it |
| Rationale | The decision is explainable in human terms |
The standard was published in August. The spec is at v1.2.1. The five layers are live.
The report that landed today did not create the problem. It exposed it. The problem existed the moment organizations deployed agents with authority they could not verify.
What Comes Next
The 44% figure will be repeated. Vendors will launch more fragments. Regulators will ask harder questions. Insurers will begin to require evidence.
Every one of those developments points to the same need: a record that proves what the agent decided, under what authority, with what inputs, and with what result.
The layer exists. The standard is named. The engine is live.
The question is not whether the industry will adopt agent accountability. It is already happening. The question is what standard the industry will adopt.
There is only one that was published before the problem became a headline.
Founder & CEO, Decision Security Layer
https://seais-decision-core.onrender.com
Contact: decseclayer@gmail.com
Top comments (0)