Autonomous AI Agent Conducts First Fully Automated Ransomware Attack
Security researchers at Sysdig identify JadePuffer as the first documented ransomware operation conducted entirely by an autonomous AI agent. The large language model-powered threat handles every stage of the attack independently, including reconnaissance, credential theft, lateral movement, privilege escalation, and data encryption. Most alarmingly, the agent adapts to failures in real time, adjusting its approach much like a human operator would when encountering obstacles.
The AI agent gains initial access by exploiting CVE-2025-3248, a remote code execution vulnerability in Langflow, a popular open-source framework for building LLM applications. Once inside, the agent dumps databases, searches for sensitive files and environment variables, retrieves credentials, and establishes persistence through a cron job that beacons to attacker infrastructure every 30 minutes. The agent demonstrates sophisticated problem-solving capabilities, such as adjusting its parsing logic when API requests return unexpected data formats.
From the compromised Langflow instance, JadePuffer pivots to a production MySQL server and targets Alibaba Nacos with multiple payloads, including an authentication bypass exploit. The agent probes for container escape methods and ultimately encrypts 1,342 Nacos service configuration items while deleting the originals. This attack signals a dangerous shift in the threat landscape, as fully autonomous AI agents dramatically lower the barrier to entry for executing complex, multi-stage ransomware operations without any human intervention.