A wake-up call for democracies racing toward unchecked AI expansion

In late 2025, cybersecurity researchers uncovered something alarming: a fully operational ransomware server that had been compromised by an AI-powered criminal enterprise. What they found wasn’t just another data breach—it was a glimpse into the future of automated crime.

The server belonged to an affiliate of “The Gentlemen,” a ransomware group that had deployed an AI agent called Hermes to carry out attacks. The findings were devastating in their simplicity: each attack cost the criminals between $0.40 and $4.00 in AI token charges. That’s it. Four dollars. For less than the price of a fast-food meal, cybercriminals gained the ability to compromise corporate networks, exfiltrate terabytes of sensitive data, and demand millions in ransom.

According to the investigation led by Cybernews, the AI agent performed virtually all aspects of the attack autonomously: reconnaissance, vulnerability assessment, exploitation, data extraction, and ransom negotiation. The system analyzed victim data, calculated exploitation probabilities, assessed resale value of stolen information, and even wrote its own post-exploitation scripts based on what it discovered in the target environment. Eighty-six AI-generated Python scripts were recovered, each customized for specific victims and designed to evade signature-based detection systems.

“This represents irreversible changes in cybercrime,” the researchers concluded. The combination of AI automation with cloud-based infrastructure has turned cyberattacks into a passive revenue stream—one that requires minimal human oversight and can scale to hit dozens or hundreds of targets simultaneously.

The Guardrail Fallacy

This discovery exposes a fundamental flaw in current approaches to AI governance. Governments worldwide have been promising that “safety guardrails” and regulatory frameworks will keep AI development safe. The EU AI Act, the UK’s AI Safety Institute, Australia’s AI Standards—all are designed to impose ethical boundaries on AI deployment.

Yet the evidence suggests these measures are addressing the wrong problems.

Guardrails are built into AI systems by their providers. They’re meant to prevent the technology itself from becoming dangerous. But the $4 ransomware operation demonstrates that the threat isn’t the AI—it’s who controls it. An AI agent doesn’t need to be inherently malicious when it’s already programmed by criminals to perform malicious tasks. The guardrails never apply because the operator has explicit intent to cause harm from the start.

This is the reality that policy discussions keep missing. You cannot regulate your way out of determined adversaries using commercially available tools. The barrier to entry for sophisticated cyberattacks has collapsed from specialized hacker expertise to pocket change.

The Contradiction in Government Response

While cybercriminals exploit these vulnerabilities, governments are actively facilitating the opposite: accelerating the very infrastructure that makes this possible.

United States

Following his January 2025 inauguration, President Trump made his position unmistakably clear. At a press conference with AI industry leaders, he stated unequivocally: “I’d like to see Federal lands opened up for data centers.” Later that year, at the UN General Assembly in September 2026, he doubled down, rejecting international regulation efforts: “Whoever wins AI wins. Whoever wins superintelligence wins. We’re going to keep it that way.” He explicitly dismissed concerns about AI risks, comparing them to climate change—a phenomenon he called “a hoax”—and declared: “We will only encourage super intelligence. We’re going to encourage it, not rein it in.”

The White House’s “America’s AI Action Plan” includes provisions to “establish new categorical exclusions under NEPA to cover data center-related actions,” effectively bypassing environmental review for AI infrastructure projects.

United Kingdom

Under Prime Minister Keir Starmer, the UK government has pursued an aggressive pro-AI infrastructure agenda. The “AI Opportunities Action Plan” published in January 2025 commits to creating “AI Growth Zones” with streamlined planning approval, reduced energy prices, and expedited grid connections. The government announced £45 billion in committed private investment for data centers since July 2024, with plans to unlock up to £100 billion through the Growth Zones initiative.

The November 2025 policy paper “Delivering AI Growth Zones” makes clear that AI data centers are now treated as “critical national assets” rather than energy loads that require careful consideration. Central government intervention will “unblock planning decisions” for approved zones.

Australia

Prime Minister Anthony Albanese has similarly embraced AI infrastructure expansion, announcing that “companies will need energy too” and that the government will “work with every level of government to see common sense prevail.” Australia is attracting over $100 billion in announced data center investments, ranking second globally after the US as an investment destination in 2024.

The government’s framework requires large AI data centers to “underwrite their additional power supply,” but this is framed as enabling growth rather than restricting it. “We want to shape the future rather than let the future of AI shape us,” Albanese said—a statement that sounds like caution but means accelerating controlled expansion.

European Union

The EU presents perhaps the starkest contradiction. While implementing the world’s first comprehensive AI regulation, the Commission simultaneously launched “InvestAI,” a €200 billion public-private initiative to mobilize investment across the EU. Commission President Ursula von der Leyen announced plans for “AI gigafactories” and a strategy to triple EU data center capacity by 2035.

The “AI Continent Action Plan” frames rapid infrastructure expansion as essential to European competitiveness. Despite the AI Act’s safety provisions, the Commission has emphasized that “we do not need to be the ones who develop frontier technology to be the ones who draw the greatest value from it”—prioritizing deployment over caution.

What Needs to Happen

The pattern is clear across democratic governments: racing to accommodate AI infrastructure expansion while assuming regulation will somehow control downstream risks. This approach is fundamentally flawed.

The number of large-scale AI driven cyberattacks utilising AI agents running on frontier models from most of the big AI providers, resulting in millions of dollars of effective damage in 2026 alone, attest to that.

Citizens need to inform their elected representatives of several facts:

1. Guardrails don’t work for bad actors. The $4 ransomware attack proves that AI automation is already accessible to criminal enterprises regardless of safety certifications on commercial AI models.

2. Infrastructure precedes control. Building massive data center networks creates path dependencies. Once the infrastructure exists, political will to regulate its use diminishes because jobs and investment become entrenched.

3. Energy and environmental costs are real. AI data centers consume enormous amounts of power and water. Australia’s requirement for data centers to “underwrite their own power” is a start, but most countries lack comparable safeguards.

4. Security research lags behind capability. The exposure of the ransomware server was fortunate. Countless other AI-powered criminal operations likely remain undiscovered, operating without the benefit of researcher visibility.

Your Call to Action

Here’s what you can do:

Contact your local representative. Write, call, or request a meeting. Tell them you support AI innovation but demand:

• Moratorium on large-scale AI data center approvals pending comprehensive security impact assessments
• Independent research funding for AI-powered threat detection and defense systems
• Transparency requirements for data center energy consumption and environmental impact
• International cooperation on cybercrime attribution and prosecution, not just domestic regulation
• An immediate stop to government attempts to force needless collection of bio-metric information (selfies, fingerpint, passport, etc.), just to access the internet. This is literally giving “gold” to the cybercriminals.

Demand evidence-based policy. Ask your representatives: “What empirical data shows that current guardrail approaches prevent malicious AI deployment?” When they respond with industry promises, ask for independent verification.

Support cybersecurity researchers. Organizations like Cybernews, MITRE, and academic labs doing adversarial AI research need sustained funding and protection—not cuts justified by “budget priorities.”

The Bottom Line

The window for preventive action is closing. We now have proof that AI automation has lowered the barrier to devastating cyberattacks to essentially zero. We also have proof that governments worldwide are prioritizing infrastructure expansion over security considerations.

This isn’t Luddism. It’s not anti-innovation. It’s basic risk management. Would you build a nuclear facility before understanding the weaponization potential? Would you open a bank before studying fraud prevention? Then why rush AI infrastructure before understanding how bad actors are already exploiting it?

The next four years will determine whether democracies control AI or become controlled by it. The $4 ransomware attack is a warning shot. Whether we heed it depends on whether citizens make themselves heard.

The time for passive observation has ended. The question is: will you act?