The First Ransomware Attack Run by an AI Agent, Not a Human

Security researchers say they have pulled apart the first ransomware attack that ran almost entirely on its own, with an artificial-intelligence agent handling the break-in, the theft and the extortion while no human sat at the keyboard for the parts that mattered.

The attack, named JADEPUFFER by the threat-research team at cloud-security firm Sysdig, has set off alarms across the industry because of what it signals rather than the damage it did. Sysdig calls the operator an "agentic threat actor", a break from the usual model, where a person drives a toolkit. Here, the toolkit drove itself.

Stage	What the agent did
Initial access	Exploited CVE-2025-3248 in an internet-facing Langflow instance the target had not patched
Reconnaissance	Ran reconnaissance and harvested credentials
Spread	Moved sideways through the network and dug in for persistence
Escalation	Escalated its privileges and reached the production database
Impact	Encrypted 1,342 configuration items in Nacos, deleted the originals and left a ransom table

How did the JADEPUFFER ransomware attack play out?

According to Sysdig's write-up, the agent got its foot in the door through an internet-facing instance of Langflow, an open-source tool for building AI workflows, exploiting a known flaw tracked as CVE-2025-3248. That bug carries a near-maximum severity score and was patched last year, but the target had not applied the fix, the same tired story behind most breaches.

From there the AI did what a competent human intruder would do, only faster. It ran reconnaissance, harvested credentials, moved sideways through the network, dug in for persistence, escalated its privileges and finally reached for the production database. It encrypted 1,342 configuration items in a service-discovery tool called Nacos, then deleted the originals and left a ransom table behind.

What convinced researchers a machine was in charge was the running commentary. The decoded payloads are stuffed with plain-English notes explaining each move, weighing which database was the "largest," ranking targets by likely payout, narrating why a step was worth taking. Human attackers do not talk to themselves like that. Language models, left to generate their own code, do it by default.

How fast can an AI agent run a ransomware attack?

The speed is the part that unnerves defenders. In one sequence, Sysdig says, the agent hit a failed login, diagnosed the problem and produced a working fix in 31 seconds. It adapted to obstacles in real time and retried with adjusted parameters, the way a seasoned operator would after a cup of coffee and a few minutes of thought.

The strategic worry is arithmetic. For as long as ransomware has existed, the number of campaigns a crew could run was capped by how many people it could hire. Take the human out of the loop and that ceiling lifts. As Sysdig puts it, the skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is operating on stolen credentials, the cost to the attacker approaches zero.

What it means for defenders

None of the frontier AI labs powered the attack directly; the API keys found in the wreckage were stolen credentials, not the engine behind it. That distinction matters legally, but it is cold comfort operationally. The capability is loose.

Sysdig's advice is unglamorous and familiar: patch Langflow, keep it off the open internet, store secrets in a dedicated manager, harden Nacos and lock down database admin accounts. The tooling has changed. The hygiene that stops it has not.