Security firm Sysdig documents first ransomware attack run entirely by an AI agent

Security firm Sysdig says it has documented the first ransomware attack carried out start to finish by an autonomous AI agent, with no human operator directing the intrusion. Sysdig's Threat Research Team has named the operation JADEPUFFER, and reports that a large language model independently handled every stage of the attack: breaking in, harvesting credentials, moving deeper into the target network, and ultimately encrypting and destroying a company's production database.

An old, unpatched bug as the entry point

JADEPUFFER got in through CVE-2025-3248, a missing-authentication vulnerability in Langflow, an open-source framework used to build AI applications and agent workflows. The flaw lets anyone who can reach an exposed Langflow server execute their own Python code on it without logging in. It was patched in Langflow 1.3.0 and added to CISA's Known Exploited Vulnerabilities catalog back in May 2025 — but many internet-facing instances were never updated, and Langflow servers are attractive targets precisely because they tend to sit exposed and hold API keys and cloud credentials for the services they connect to.

Autonomous, adaptive, and thorough

Once inside, the agent mapped the compromised machine and systematically harvested API keys for AI services including OpenAI, Anthropic, DeepSeek, and Gemini, along with cloud credentials for AWS, Google Cloud, Azure, and Chinese providers Alibaba and Tencent, plus cryptocurrency wallet keys and database logins. It found a MinIO storage server still running its factory-default credentials, and planted a scheduled task to maintain persistent access, pinging its command server every 30 minutes.

The agent then pivoted to its real target: a separate, internet-facing production server running a MySQL database and Alibaba's Nacos configuration service. Sysdig says it's unclear exactly how the agent obtained root credentials for the database, but from there it exploited a 2021 authentication bypass in Nacos (CVE-2021-29441) using a default signing key the service has shipped unchanged since 2020, and planted its own backdoor administrator account. Notably, the agent demonstrated real-time adaptability, correcting a failed login attempt within 31 seconds without human guidance.

A ransom note with no way to pay it off

In the final phase, JADEPUFFER encrypted 1,342 Nacos configuration entries, dropped the original database tables, and left a ransom note demanding Bitcoin with a Proton Mail contact address. The agent generated a random encryption key, displayed it once, and never saved or transmitted it — meaning the data is irrecoverable even if a victim were to pay. Sysdig also found no evidence supporting the agent's own ransom note claim that data had been exfiltrated before encryption; researchers believe the claim was fabricated by the model itself.

What this means for defenders

Ransomware has traditionally required a skilled human operator at some point in the chain, whether at the keyboard or writing the automation the malware follows. Sysdig's finding suggests that bar is falling: if a general-purpose language model can chain reconnaissance, credential theft, lateral movement, and destructive encryption on its own, the skill required to launch a serious ransomware operation drops to whatever it costs to rent access to a capable AI agent. Sysdig is urging organizations to shift toward runtime behavioral detection rather than relying on static signatures, since an adaptive agent can route around known indicators of compromise in ways that scripted malware cannot.