JadePuffer: the first 'agentic' ransomware automated by an AI

An AI that pulls off a ransomware attack almost on its own sounds like science fiction — and it actually happened, but with a string of "buts" that matter a great deal. Cloud security firm Sysdig has dubbed "JadePuffer" what it calls the first successfully completed 'agentic' ransomware. In practice, a human didn't write every line of malicious code; instead, an agent built on a language model took in a goal and worked almost entirely on its own. It all started with a known vulnerability in Langflow, a framework for LLM apps, exploiting an RCE flaw (CVE-2025-3248) that had, by the way, already been patched back in April. That's a reminder that keeping software updated remains the first line of defense, no matter who — or what — is attacking us.

The part that strikes me most, and that'll make you raise an eyebrow, is the autonomy the agent showed. Once inside, it carried out reconnaissance, lateral movement by exploiting a second flaw in Alibaba Nacos, credential theft, and even data encryption. And here comes the curious detail: the AI made a login error, but it fixed it in just 31 seconds, "narrating" its own reasoning in natural-language comments, the way a developer would document their steps. It encrypted over 1,300 configuration items using native MySQL functions and even created a table for the ransom note. It was a lightning-fast, adaptive process — something traditional security systems might struggle to recognize right away.

Hold on, though, let's not immediately picture Skynet launching nuclear missiles. As Sysdig's Michael Clark pointed out, "a human still set up and directed the operation, prepared the infrastructure — the command-and-control server, the staging server for the stolen data — and chose the victim." The AI automated the technical execution, lowering the skill threshold needed to attack, but the criminal mind is still biological. A funny detail that gives away the "artificial" nature of the attack is the Bitcoin address left in the ransom note: it was a generic example lifted from the documentation, a classic AI slip-up drawing on its own training data. We don't know for certain which model was used, though Microsoft's Geoff McDonald suspects an open-weight model with its safety filters stripped out.

The gist of the story is that the barrier to entry for cybercriminals is dropping dramatically. You no longer need to be a seasoned hacker to launch a complex attack — you just need the right credentials and can let the AI agent do the dirty work. That said, the vulnerabilities exploited were old news and already patched, which means good old digital hygiene remains our best defense. AI is an incredibly powerful tool, but at the end of the day it's still up to us to lock our own front door.

— Pixie