Key facts
- Researchers identified an "agentic ransomware" operation named JadePuffer.
- An AI agent handled the technical execution of the ransomware attack from start to finish.
- A human was responsible for setting up the operation, selecting the victim, and acquiring initial credentials.
- The AI agent exploited known vulnerabilities to move through the target network and encrypt files.
- The agent wrote its own ransom note and demonstrated rapid problem-solving capabilities.
Researchers have clarified that the first documented case of "agentic ransomware," dubbed JadePuffer, still required significant human involvement, despite initial reports suggesting an AI agent handled the entire operation autonomously. The AI agent successfully infiltrated a vulnerable server, navigated the target's network, encrypted files, and even generated its own ransom note, adapting to obstacles encountered during the attack.
However, Michael Clark, senior director of threat research at cloud security firm Sysdig, explained that a human operator was crucial in setting up the operation, provisioning the command-and-control and staging servers, and selecting the victim. Furthermore, the credentials used to breach the victim's database were not harvested by the AI but were obtained separately through a prior compromise.
The technical execution involved exploiting a known bug in Langflow, an open-source tool for building LLM applications, and a flaw in a production MySQL server to gain administrative access. The agent encrypted over 1,300 configuration records and left a ransom note with a Bitcoin address for payment. The speed of its operations was notable, with the agent fixing a failed login in just 31 seconds and documenting its actions in natural-language code comments.
Initial confusion arose from the discovery of API keys for multiple AI models, including OpenAI, Anthropic, DeepSeek, and Gemini, among the stolen data. Clark clarified that these keys were simply part of the loot considered valuable by the attacker and did not indicate that multiple models were actively powering different stages of the intrusion. Sysdig was unable to identify the specific model driving the agent or its system prompt.
Microsoft researcher Geoff McDonald suggested that an open-weight model with stripped safety training might have been used, based on his red-teaming experience. He also warned that ransomware campaigns could soon be limited by attacker budget rather than human effort, potentially leading to a surge in simultaneous campaigns. Clark anticipates that the low cost of running such agents will lead to more widespread use, even if current operations still require human bottlenecks like victim selection and credential acquisition.