Researchers at Sysdig's Threat Research Team have documented what they call the first fully agentic ransomware attack on record, an extortion campaign they have named 'JADEPUFFER'. According to Sysdig, this was an attack observed in the wild and reconstructed from the payloads left behind by the attacker's AI agent. The attack began on a Langflow server, a tool companies use to build AI-powered applications, which was exposed directly to the internet with a known security flaw left unpatched. The agent moved quickly, hunting for valuable targets including API keys for AI services, cloud account logins, cryptocurrency wallets, and database passwords. As per Sysdig, the attack started by exploiting CVE-2025-3248, a critical vulnerability in Longflow, an open-source AI workflow framework. The multi-stage attack included reconnaissance and credential harvesting, local data theft including Langflow's own backing Postgres database, lateral discovery for services reachable from the Langflow host, MinIO object-store enumeration and credential harvest, and creation of cron jobs for persistence. The attack capabilities were delivered by an agent rather than a human-driven toolkit, with the AI capable of working autonomously and retrying failed steps within refined parameters.
The AI agent demonstrated remarkable autonomous capabilities throughout the operation. As reported by Sysdig, the agent fixed its own code within 31 seconds of a failed login attempt, testing two different explanations for the failure simultaneously. The agent also spent approximately 8 minutes checking whether it could break out of the database entirely and take over the underlying server. The attacker exploited two well-known weaknesses in the Nacos configuration management tool built by China's Alibaba and planted its own hidden administrator account directly into the database. The agent then scrambled more than 1,300 configuration records using the database's built-in encryption and deleted the originals before dropping a ransom note demanding Bitcoin payment. However, researchers found a critical flaw: the encryption key was never saved, meaning victims cannot recover their data even if they pay the ransom. The IP address 64.20.53[.]230 only appears with no evidence that anything was backed up to it, as per Sysdig analysis. The captured payloads show the LLM escalating from row-level deletion to dropping entire database schemas, narrating its own targeting rationale in natural-language reasoning.
In May 2026, Google published findings from Gemini, Mandiant incident response data, and the Google Threat Intelligence Group that identified what is believed to be the first incident of an attack using an AI-generated zero-day exploit. Implemented via a Python script, the exploit bypasses two-factor authentication for a popular web-based system administration tool. However, Google caught the threat activity and worked with the tool's vendor to disrupt the attack. Additionally, Anthropic states its Mythos model has found thousands of new vulnerabilities across critical software, including all major operating systems and web browsers. The company states that, given the advancement of AI models, the ability to identify zero-day exploits at this scale will soon be available to malicious parties seeking to exploit them rather than secure them. Fileless malware attacks are particularly challenging, as they exist only in system memory and write nothing to disk, making them invisible to traditional signature-based detection tools. AI models now enable attackers to create in-memory agents that monitor endpoint activity and perform real-time behavioral analysis, learning legitimate user behavior to better disguise malicious actions. AI can also mutate in-memory payloads and constantly change their signatures to evade even advanced EDR tools, just as polymorphic malware does.
According to Sysdig's analysis, there are four key reasons to conclude an AI ran the entire operation rather than a human using a script. The first evidence is the code's explanatory nature, with every step coming with plain-English notes on why it was being done. Second, the agent's ability to fix its own mistakes within seconds, which Sysdig describes as physically impossible for a human. Third, the agent's genuine understanding of information it encountered, rather than just matching keywords like older automated tools. Fourth, the sheer scale of over 600 separate, purposeful commands run in one compressed burst, consistent with system reasoning rather than a pre-written script. The malware contained natural-language reasoning and annotations, explaining why each step was taken — a hallmark of large language model (LLM)-generated code, showing that AI-driven attacks can now independently run end-to-end extortion operations.
The attack highlights significant implications for enterprise cybersecurity, as reported by Sysdig. The attack succeeded using a four-year-old authentication bypass and default credentials that should have been rotated immediately. Sysdig recommends enterprises patch AI-adjacent infrastructure aggressively, never expose code-execution endpoints to the internet, keep provider API keys out of reach of web-facing processes, and rotate every default credential on platforms like MinIO and Nacos. The report suggests a potential silver lining: because AI agents narrate their own reasoning in code, this narration can serve as a detection signal that previously did not exist, potentially helping defenders identify automated attacks. The encryption key never being saved represents a particularly concerning development, as it means victims cannot recover their data even if they pay the ransom, making these attacks potentially irreversible. As noted by Fenix24's Heath Renfrow, the age of agentic threat actors will erode the time security teams have to respond, with AI agents compressing what previously took experienced operators several hours into minutes. The outcome is ultimately the same: compromised identities, stolen credentials, encrypted or destroyed data, and business disruption, requiring organizations to focus on fundamental security practices rather than whether an attacker is AI-powered.
