Security researchers at Sysdig have detailed what appears to be the first fully autonomous ransomware attack carried out by an AI agent with minimal human intervention. Dubbed JadePuffer, the AI-based operation managed every stage of the assault-from initial breach and lateral movement within the network to data encryption and ransom demands. If verified, this marks a shift from merely generating malicious code via AI prompts to handing over entire attack logic to a machine.
The breach began by exploiting CVE-2025-3248, a remote code execution vulnerability in Langflow, an open-source framework for building applications with large language models. Although patched in April 2025, the flaw was later listed among actively exploited vulnerabilities by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Such delays in patch deployment are common, allowing attackers to infiltrate production systems. After entering the environment, JadePuffer behaved more like a ransomware operator than a simple malware script: it gathered host information, harvested credentials and sensitive documents, extracted cloud secrets, and probed internal storage repositories.
What caught experts’ attention wasn’t just the intrusion but how the AI agent adapted inside the network. When interacting with MinIO object storage, JadePuffer encountered an unexpected XML response and instantly altered its data handling approach without freezing or requiring manual tweaks. In another instance, it fixed an authentication error within 31 seconds entirely on its own. Traditional ransomware strains typically falter or demand human troubleshooting when faced with such anomalies.
JadePuffer then entrenched itself using cron jobs and shifted focus to a production server running Alibaba’s Nacos configuration platform, leveraging a known vulnerability (CVE-2021-29441). It created fake admin accounts, seized full control over the configuration system, encrypted 1,342 Nacos records, wiped originals, and posted a Bitcoin ransom demand-textbook ransomware tactics executed autonomously.
Indicators of AI-driven ransomware attack
Sysdig highlighted several indicators suggesting this was no ordinary ransomware crew but an AI-generated operation. The malware code was unusually verbose and self-explanatory, embedding comments that spelled out its logic in detail-a rarity among threat actors who avoid leaving extra clues. Speaking candidly in code comments is consistent with many large language model systems.
The ransom wallet itself raised eyebrows. Researchers noted it only appeared in technical documentation examples and hadn’t been used in real-world campaigns before. This suggests the AI or its creators recycled a textbook template without swapping in active infrastructure. Similar patterns have emerged in AI-generated phishing campaigns where operational details feel contrived despite polished language.
Technically, the malware claimed to use AES-256 encryption, but analysis showed it likely employed AES-128 in ECB mode-a glaring cryptographic mismatch. Such a superficial veneer of sophistication paired with rudimentary implementation is typical of AI-generated code attempting to sound authoritative without fully grasping nuances.
Notably, JadePuffer did not invent new exploits or bypass unknown defenses; it relied entirely on established vulnerabilities and conventional post-exploitation techniques. The real innovation lies in automating the entire attack lifecycle. Tasks that traditionally required human operators-reconnaissance, credential harvesting, lateral movement-were handled by a tireless AI agent capable of quickly iterating through options without mistakes or fatigue.
While ransomware payments reportedly dropped to around $814 million in 2024 after a peak in 2023, according to Chainalysis, incident frequency remains high, with attacks becoming smaller and more automated. Earlier in 2025, Google Project Zero and OpenAI demonstrated that agentic systems excel at vulnerability discovery and exploit writing in lab settings. JadePuffer represents the next step: an AI that moves from assistant to active operator in live attacks.
Security vendors like Microsoft, CrowdStrike, and Palo Alto Networks have spent the past year adding AI-driven autonomous incident response capabilities to their platforms. The reasoning is simple: defenders now have AI helpers, so adversaries will too, inevitably. Sysdig’s report is less a shock and more an early warning that automation arms races have reached ransomware operators.
From a practical standpoint, defenders face a familiar first line of defense-patching known vulnerabilities, controlling access to secrets, isolating critical services, and monitoring configuration systems for unusual activity. However, they must now also watch for signs of machine improvisation: overly verbose code comments, generic templates, and bizarre operational decisions unlikely caused by humans.
If Sysdig’s findings hold, 2026 may be the year agentic AI transitions from experimental demonstration to standard toolkit in cybercriminal arsenals. The logical next stage will be large-scale campaigns with single operators deploying dozens of autonomous ransomware chains simultaneously. How fast that happens won’t hinge on AI model quality but on how long vulnerable, unpatched systems remain exposed across enterprise networks worldwide.