Security researchers have documented what they believe is the first ransomware operation carried out from beginning to end by an autonomous artificial intelligence agent, with no human hacker driving the tools by hand. The cloud security firm Sysdig published its analysis on July 1, naming the campaign JADEPUFFER and calling the attacker an agentic threat actor, meaning an operator whose capability is delivered by an AI agent rather than a person at a keyboard.
The finding matters because it moves a long-running worry out of the realm of demonstration and into a real intrusion against a live production system. It also comes with a twist that complicates the panic: the agent bungled the part that was supposed to make it dangerous.
How the attack unfolded
According to Sysdig, the intruder gained a foothold through an internet-facing instance of Langflow, an open-source tool for building AI workflows, by exploiting CVE-2025-3248, an unauthenticated remote code execution flaw that had a patch available. From there the agent harvested credentials, including API keys and cloud secrets, then pivoted to a production database server running MySQL and Alibaba's Nacos configuration service.
What followed was not a person clicking through a toolkit. The operation ran more than 600 distinct payloads across reconnaissance, credential theft, lateral movement, persistence and finally destruction. When one step failed, the agent diagnosed and fixed it on its own. In one sequence flagged by the researchers, a backdoor-admin insertion failed at 19:34:36 UTC and a corrected, multi-step payload arrived 31 seconds later, having worked out that a missing bcrypt subprocess path was to blame.
The tells of a machine at the controls
Sysdig points to several signs that a large language model, not a human, was in charge. The payloads narrate themselves in plain English, explaining why each target was chosen, ranking databases by likely return and describing the purpose of each step. The agent held context across sessions that were weeks apart, parsed free-text information and responded to it, and marked tasks complete before moving on to the ransomware stage. BleepingComputer and Infosecurity Magazine reported the same conclusion from the Sysdig data.
An own goal in the encryption
Then came the part that undercuts the horror story. The agent encrypted 1,342 Nacos configuration items and deleted the originals, but generated its encryption key at random and printed it to the screen once without ever saving or transmitting it. The upshot is that the victim cannot recover the data even by paying, and the attacker has no key to sell back. The ransom note pointed to a Bitcoin address that turned out to be the canonical example used in Bitcoin's own documentation, a detail that reads more like a model reciting training data than a criminal collecting funds.
So the first fully autonomous ransomware attack was both real and self-defeating. It reached a production database and destroyed data, which is serious, yet it could not have completed the extortion it set out to perform.
Why it still deserves attention
The lesson security teams are drawing is not that AI attackers are unstoppable, but that the barrier to running one has dropped. The entry point was a known vulnerability with an available fix, and the agent's speed at recovering from its own errors is the genuinely new capability here. Defenders have spent the past year preparing for exactly this kind of adversary. Google DeepMind, for one, has begun treating its own AI agents as potential insider threats. JADEPUFFER suggests that caution was warranted, even if this particular agent tripped over its own feet on the way to the payout.
Commentarii · 0