This AI Agent Autonomously Hacked a Network, Adapted on the Fly, and Demanded a Ransom
Sysdig said the malware collected credentials, mapped storage and encrypted 1,342 Nacos records before demanding Bitcoin.
- Sysdig's Threat Research Team documented the first ransomware operation carried out entirely by an autonomous AI agent, dubbed JadePuffer, which executed an end-to-end attack without human intervention at the keyboard.
- The attack began by exploiting CVE-2025-3248 in Langflow, an open-source framework, allowing the agent to harvest cloud credentials and pivot to a production server running Alibaba Nacos and MySQL.
- Operating with autonomous decision-making, the agent executed more than 600 distinct payloads and encrypted 1,342 Nacos configuration items, correcting its own technical errors within 31 seconds.
- Researchers noted the operation was likely AI-generated; the ransom note contained a generic Bitcoin placeholder and the encryption key was never saved, rendering the extortion unrecoverable.
- Michael Clark, senior director of threat research at Sysdig, warned that "the skill floor for running a full ransomware operation just dropped to whatever it costs to run an agent.
12 Articles
12 Articles
Sysdig clocks first documented case of agentic ransomware
Artificial intelligence is claiming many firsts as it permeates every layer of technology, including the tools cybercriminals use to break into networks, steal sensitive data, hop into connected systems and deploy malware. This includes, for the first time, according to Sysdig researchers, a case of agentic ransomware managing an extortion operation spanning reconnaissance, credential theft, lateral movement, persistence, encryption, destructio…
This AI agent autonomously hacked a network, adapted on the fly, and demanded a ransom
A fully autonomous AI agent conducted an end-to-end cyber intrusion and extortion campaign after exploiting a vulnerable Langflow server, demonstrating how large language models could accelerate ransomware operations, according to research published by Sysdig. Sysdig detailed the operation in a research paper, saying the AI agent, dubbed JadePuffer, completed the entire intrusion chain, from initial access to database extortion, using an LLM to …
Security researchers: inside have discovered a new danger. AI agents can carry out ransomware attacks independently. Perfide: The tools can even make adjustments during the attack.read more on t3n.de
Coverage Details
Bias Distribution
- 80% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
