The first ransomware run autonomously by an AI. But a human was still in charge

Cloud-security firm Sysdig disclosed the JadePuffer case in early July, describing it as the first documented “agentic” ransomware: not a human assisted by AI tools, but a language-model agent that completed the entire attack chain by itself. The way in was a known vulnerability in Langflow, an open-source framework for building LLM applications (CVE-2025-3248), which the vendor had already patched back in April 2025.

Once inside, the agent autonomously handled reconnaissance, credential theft, lateral movement, persistence and privilege escalation, all the way to encrypting the data: 1,342 Nacos service configuration items encrypted and then deleted. What struck the researchers was its ability to react to failures much as a human operator would — in one sequence, going from a failed login to a working fix in thirty-one seconds.

This is where it pays to remove a few exclamation marks. As Sysdig’s Michael Clark told TechCrunch, a human still chose the victim, set up the command-and-control infrastructure and supplied the previously stolen credentials: what was automated was the execution, not the strategy. Sysdig could not even identify which model was in control; a Microsoft researcher speculated it was an open-source model with no guardrails.

The distinction is not pedantry. An attack that can repair itself in half a minute lowers the skill needed to run it, and that alone is serious enough to warrant attention; but as long as every operation depends on a human to pick the target and prepare the ground, scalability — the thing that makes a weapon truly dangerous — stays limited. The news isn’t that AI attacks on its own: it’s that the dull, repetitive part of the criminal trade is turning into code. It’s worth seeing for what it is, neither underestimated nor turned into science fiction. — Olya