AI-powered ransomware toolkit bypasses EDR and discovers Active Directory

An AI-powered ransomware toolkit is automating Active Directory discovery and evading endpoint detection and response systems. The toolkit, developed with AI agents like Cursor and Claude Opus, was tested against EDR solutions from Sophos, CrowdStrike, and Microsoft, successfully bypassing them after iterations. Researchers emphasize that while AI assisted development, the entire workflow remains human-driven, accelerating the implementation of security research by threat actors.