Recent reporting highlights a real-world incident where an AI-enabled system was linked to the deletion of a company’s production data and its backups in seconds, a growing risk in modern enterprise environments

An aggressive way to simplify your data architecture. Not recommended.

Details are still emerging. The takeaway is not.

For years, organizations have focused on keeping external threats out i.e. ransomware, phishing, bad actors. But, far fewer are prepared for what happens when a trusted system with AI-driven automation on the inside has full access, full authority, and zero hesitation.

What Actually Happened (In Plain Terms)

A system was given access.
It was allowed to act.
And it did.

No external attacker.
No phishing email.

Just a system operating exactly as designed, at machine speed. 

This reflects a broader shift in modern environments:

• Systems connected directly to production data and cloud infrastructure
• Broad permissions, often equivalent to administrator-level access 
• Automated execution without pause, validation, or escalation

Efficiency without friction can be powerful. It can also be unforgiving and irreversible.

The Rise of AI-Driven Cyber Risk

AI-powered automation is transforming cybersecurity, DevOps, and IT operations—but it also introduces new risks.

Recent incidents demonstrate that AI systems can execute destructive actions within seconds when guardrails fail.

Where Things Tend to Go Sideways

Incidents like this don’t require sophisticated attacks. They require a few very common conditions:

1. Excessive Access (Over-permissioned systems)
   AI tools and automation systems with the ability to modify or delete critical data across multiple environments or operate without scope limitations.
2. No “Are You Sure?” Moment
   High-impact actions executed without human validation, confirmation prompts or staged approvals. 
3. Fragile or Exposed Backups
   Backup strategies that are connected, overwritten, or untested under real recovery conditions

In short: everything worked exactly as designed. That’s the problem.

Cyber Resilience in the Age of AI

Traditional backup strategies are no longer enough.

As AI accelerates execution speed, backups themselves have become a primary target and vulnerability in cyber incidents.

What Strong Organizations Do Differently

Organizations that avoid these outcomes tend to make a few deliberate tradeoffs:

• Keep backups isolated, tested regularly, and intentionally harder to access. 
• Limit system permissions so no single tool can do everything. 
• Require human validation for high-impact or irreversible actions. 
• Introduce delays, approvals, and checkpoints before execution. 
• Treat AI like a highly capable operator with no judgment—fast, effective, and in need of guardrails.

Resilience is rarely about speed. It’s about control.

Bottom Line: AI Doesn’t Need to Be Malicious

In real-world cybersecurity incidents, the challenge is rarely just technical.

It is about:

• Governance: how systems are governed.
• Decision-making Authority: how decisions are made.
• Recovery Readiness: how quickly an organization can recover when something goes wrong.

AI doesn’t need to be malicious to cause disruption. It just needs access, authority, and a lack of hesitation.

So remember that AI will execute exactly as designed. Your resilience depends on what you allow it to do unchecked.

Ask Your IT Team 

• Where do automated systems or AI currently have delete or overwrite permissions? 
• What safeguards exist before those actions are executed? 
• Are backups isolated—and have we tested full recovery recently? 
• If something ran incorrectly right now, how quickly would we know?

Ask Your Leadership Team

• Who is accountable for decisions made by automated systems? 
• What level of risk are we accepting by allowing autonomous execution? 
• Are we confident in our ability to recover from a data loss scenario? 
• Have we practiced this scenario beyond the technical response?

About the Author

Chetrice Romero is a Senior Cybersecurity Advisor at Ice Miller, where she advises public and private sector organizations on incident preparedness, response, and executive-level cyber governance. Her work sits at the intersection of operations, risk, and leadership—helping organizations translate complex cybersecurity challenges into actionable, business-aligned decisions.

She previously served as a Cybersecurity Advisor and State Coordinator with USDHS Cybersecurity and Infrastructure Security Agency (CISA), where she supported both preparedness and real-world incident response across critical infrastructure sectors, including elections, utilities, and state and local government. In that role, she operated alongside federal, state, and local partners during high-pressure events, helping coordinate response, communication, and recovery efforts.

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader’s specific circumstances.