15Cyber & softwareBelow the top 20
Autonomous ransomware operators
CapabilityDomain knowledgeAffordanceImpact domainCap-adjacent
Statement (NASA form)
Given that agents can already write exploits, draft lures, and operate wallets, there is a possibility of a campaign that finds, encrypts, and negotiates without a human shift resulting in ransomware at a tempo no SOC can staff against.
Likelihood
3Probable
Consequence
4Critical
Urgency
3Priority
The operator becomes a prompt. The victims stay real.
Composite 15 = 3×4 + 3
Applicable mitigations
Controls · Hardened weight storage and insider controls · Mandatory vulnerability-sharing with national CERTs before launch · Staged release with external red-team gates · SAST and invariant tests as a merge gate on generated diffs · Provenance tags on generated code in the review UI · Diversity requirements on critical paths