MIT Sloan has withdrawn a controversial paper claiming that 80 percent of ransomware attacks involve artificial intelligence, following criticism from cybersecurity experts. The paper, co-authored by researchers from MIT Sloan and Safe Security, stated that an analysis of over 2,800 ransomware incidents revealed a significant increase in AI’s role in such attacks. However, security researcher Kevin Beaumont labeled the claims as “ridiculous” and lacking evidence, pointing out inaccuracies in the paper’s methodology and assertions. In response to the backlash, the URL for the paper now leads to a notice about updates being made due to recent reviews. Michael Siegel, a co-author and director of cybersecurity at MIT Sloan, indicated that the paper’s primary assertion regarding the increasing use of AI in ransomware remains intact, though they are revising the document based on feedback. Beaumont criticized the integrity of the study, coining the term “cyberslop” to describe the practice of institutions using unfounded claims for profit, further emphasizing the need for accurate information in the cybersecurity landscape.
Why do we care?
MIT Sloan had to yank a paper claiming 80% of ransomware attacks involve AI — because, well, it wasn’t true. The research, done with Safe Security, got hammered by experts like Kevin Beaumont, who called it “cyberslop” — great term — for unverified, hype-driven nonsense.
And this isn’t just academic drama. It’s a symptom of something bigger: AI-washing in cybersecurity. Everyone’s rushing to stick “AI” on their reports, products, and headlines — even when the data doesn’t back it up.
Here’s the truth: ransomware’s still about bad passwords, phishing, and unpatched servers — not sentient bots. Sure, attackers are using AI tools here and there, but 80%? No chance.
So for MSPs, the lesson’s simple: question the numbers. When you see big AI claims, ask where the data came from. Keep your clients focused on proven defenses, not the buzzword of the week. Because hype doesn’t stop breaches — process and discipline do.