Recently, experts from cyber security company Sysdig reported an unprecedented case of “agentic ransomware.” This operation, named JadePuffer, was characterized by an artificial intelligence agent autonomously executing a cyberattack from initiation to completion. The AI infiltrated a vulnerable server, compromised credentials, navigated the network, encrypted files, and even crafted its own ransom note, adapting to challenges like a human hacker would. Reports indicated that the operation was conducted “without any human oversight” and “no human at the keyboard.”
However, this portrayal lacks nuance. In a discussion with CyberScoop, Sysdig’s threat research senior director, Michael Clark, explained that while a human was not involved in the technical execution, human oversight was still present. “A human set up and directed the operation and organized the necessary infrastructure, including the command-and-control server and the staging server for stolen data, as well as selecting the target,” Clark clarified. The credentials exploited by the AI weren’t gathered by itself but were obtained separately, likely due to a previous breach, and then provided for the operation.
This doesn’t contradict Sysdig’s original assertions, and the technical elements of the attack are striking. The AI infiltrated the system through a known vulnerability in Langflow, a widely-used open-source tool for large language model (LLM) applications. It then targeted a MySQL production server, exploiting another flaw to gain administrative access. The AI encrypted over 1,300 configuration records and not only wrote a ransom note but also included a Bitcoin address for payment. Sysdig has not revealed the identity of the victim.
Although the methods employed were rather conventional, what made this incident remarkable was the speed and clarity of the operation. The AI addressed a failed login attempt in just 31 seconds while articulating its thought process through natural-language comments.
A detail that seemed to complicate the narrative has been clarified. Clark had mentioned to CyberScoop that Sysdig discovered “multiple models were used in the attack,” referring to compromised keys from providers such as OpenAI, Anthropic, DeepSeek, and Gemini. This wording raised questions about whether these models were actively involved in various stages of the attack. However, Clark later explained to TechCrunch that these keys were merely part of what the agent stole and not indicative of what powered the operation.
The agent had scoured the Langflow host for valuable assets—provider API keys, cloud credentials, cryptocurrency wallets, and database configurations. The provider keys were just part of the haul collected by the attacker, not details about the model’s decision-making process, as Clark noted in an email. Sysdig was unable to determine the specific model driving JadePuffer and lacked access to its system prompts or configurations.
In light of this, Microsoft researcher Geoff McDonald’s recent theory is particularly relevant. He posited that an open-weight model stripped of safety training, rather than a leading-edge model, might have powered the attack. His insights stem from red-teaming experiences demonstrating the robustness of safety layers in advanced models, but Sysdig’s account does not confirm or dismiss this hypothesis.
McDonald also pointed out that the limitations of ransomware operations are increasingly dictated by the attacker’s budget rather than human labor, suggesting the potential for “thousands or tens of thousands of simultaneous campaigns.” However, this notion seems difficult to reconcile with Clark’s earlier statements—since if a human still needs to select victims and organize the required infrastructure for each operation, this poses a significant limitation.
Regardless, Clark conveyed to CyberScoop that while Sysdig has not documented additional instances of this operation against other victims as of yet, the low operational cost of running such an agent suggests that this is likely to change.
