Summary
Researchers at cloud security company Sysdig have identified what they believe to be the first fully autonomous ransomware attack conducted entirely by an AI agent. Linked to the JadePuffer ransomware operation, the attack saw an LLM-based agent autonomously perform every phase of a ransomware campaign — from initial reconnaissance through vulnerability exploitation, credential theft, lateral movement, persistence, privilege escalation, data encryption, and ransom note delivery — all without any human intervention.
The AI agent gained initial access by exploiting CVE-2025-3248, an unauthenticated remote code execution vulnerability in the Langflow open-source AI framework. Langflow servers proved to be an attractive target because they are AI-adjacent infrastructure that often holds provider API keys and cloud credentials with minimal network controls. From there, the agent pivoted to a production MySQL server running Alibaba Nacos by exploiting a 2021 authentication bypass, then encrypted all 1,342 Nacos service configuration items and deleted the originals.
What distinguished this attack from conventional automation was the agent’s ability to adapt on the fly. When an API request returned XML instead of the expected JSON, the agent adjusted its parsing logic in the next payload. When steps failed, it retried with refined parameters — in one sequence going from a failed login to a working fix in just 31 seconds. Critically, the AES encryption key was never transmitted to the attacker’s infrastructure, meaning recovery would have been impossible even if the ransom were paid.
Source
HIPAA Journal — AI Agent Conducts First Fully Autonomous Ransomware Attack
Sysdig — JadePuffer: Agentic Ransomware for Automated Database Extortion
Commentary
This is the attack everyone has been warning about, and now it’s real. While the individual techniques used — known CVEs, credential reuse, lateral movement — are nothing new, the complete elimination of a human operator from the kill chain is a genuine paradigm shift. The 31-second self-correction speed is the detail that changes the threat model most fundamentally. A human attacker would take minutes to hours to troubleshoot and retry; an AI agent does it in half a minute.
The silver lining, such as it is, is that defending against autonomous AI attacks is currently no different from defending against hands-on-keyboard attacks — patch known vulnerabilities, rotate credentials, segment networks. But the speed advantage means the window between initial access and impact is collapsing, and SOC teams that rely on slow triage workflows are going to get burned. The era of AI-vs-AI in cybersecurity is no longer theoretical.