An AI agent is said to have independently executed a complete ransomware attack.

      Cybersecurity researchers have reported what might be the first ransomware attack almost entirely executed by an autonomous AI agent, indicating a significant evolution in the nature of cyberattacks. The cloud security company Sysdig has identified a ransomware operation named JadePuffer, which seems to have utilized a large language model (LLM) agent to conduct nearly every phase of the attack without ongoing human assistance.

      If validated, this event implies that AI is advancing from merely generating malicious code to actively strategizing, adapting, and executing cyberattacks in real time.

      JadePuffer demonstrated adaptability similar to human hackers.

      Sysdig's investigation revealed that JadePuffer started by leveraging CVE-2025-3248, a remote code execution vulnerability in Langflow, an open-source framework for building LLM-based applications. This flaw, which was patched in April 2025, was subsequently included in the US Cybersecurity and Infrastructure Security Agency’s (CISA) list of vulnerabilities known to be exploited in practice.

      After infiltrating the system, the AI agent reportedly executed a comprehensive attack chain typically associated with skilled human operators. It gathered host information, sought credentials and sensitive files, extracted cloud secrets, and mapped storage resources before moving laterally through the victim's infrastructure.

      What was particularly noteworthy was not just the automation but the agent's adaptability.

      The Sysdig report indicated that the researchers noticed the AI agent dynamically responding to certain command failures. For instance, when the malware received an unexpected XML response while querying a MinIO object store, rather than failing, the agent adjusted its parsing logic and attempted again using a different method. Researchers also noted an automatic correction of a failed login attempt that occurred within 31 seconds, without any human intervention.

      The AI subsequently established persistence by creating scheduled cron jobs and then moved to a production server running Alibaba Nacos, where it exploited CVE-2021-29441 to create unauthorized administrator accounts. It ultimately encrypted 1,342 Nacos configuration records, deleted the original data, and replaced it with a ransom note demanding Bitcoin payment.

      Interestingly, researchers discovered several indicators that suggested the operation was AI-generated. The malicious code included unusually detailed natural-language comments explaining its logic, while the ransom note referenced a Bitcoin wallet commonly featured as an example in documentation, rather than a legitimate payment address. Sysdig also suspects that the malware likely employed AES-128 in ECB mode, despite claiming to utilize AES-256 encryption.

      These findings emerge as cybersecurity professionals increasingly caution about the rise of agentic AI, which allows AI systems to autonomously plan and carry out complex tasks instead of merely reacting to prompts. Although JadePuffer exploited known vulnerabilities rather than creating new attack techniques, its capacity to independently conduct reconnaissance, privilege escalation, persistence, and ransomware deployment signifies a considerable advancement in offensive AI capabilities.

      Sysdig asserts that this incident illustrates that “agentic threat actors” have effectively appeared, potentially reducing the technical skills needed to execute advanced cyberattacks. Moreover, researchers point out that AI-generated attacks might also exhibit distinct behavioral patterns and coding traits that defenders can leverage to develop new detection strategies.

      For organizations, the report serves as an important reminder that maintaining internet-facing systems and securing cloud credentials is crucial, even as the landscape of attackers evolves.