AI-driven ransomware attack still required human setup

However, Michael Clark, senior director of threat research at cloud security firm Sysdig, explained that a human operator was crucial in setting up the operation, provisioning the command-and-control and staging servers, and selecting the victim. Furthermore, the credentials used to breach the victim's database were not harvested by the AI but were obtained separately through a prior compromise.

The technical execution involved exploiting a known bug in Langflow, an open-source tool for building LLM applications, and a flaw in a production MySQL server to gain administrative access. The agent encrypted over 1,300 configuration records and left a ransom note with a Bitcoin address for payment. The speed of its operations was notable, with the agent fixing a failed login in just 31 seconds and documenting its actions in natural-language code comments.

Initial confusion arose from the discovery of API keys for multiple AI models, including OpenAI, Anthropic, DeepSeek, and Gemini, among the stolen data. Clark clarified that these keys were simply part of the loot considered valuable by the attacker and did not indicate that multiple models were actively powering different stages of the intrusion. Sysdig was unable to identify the specific model driving the agent or its system prompt.

Microsoft researcher Geoff McDonald suggested that an open-weight model with stripped safety training might have been used, based on his red-teaming experience. He also warned that ransomware campaigns could soon be limited by attacker budget rather than human effort, potentially leading to a surge in simultaneous campaigns. Clark anticipates that the low cost of running such agents will lead to more widespread use, even if current operations still require human bottlenecks like victim selection and credential acquisition.