The first known instance of an agentic AI ransomware attack was documented last week by researchers at cloud security firm Sysdig, in which an AI agent carried out the technical, end-to-end execution of a real-world cyberattack.
The findings mark one of the clearest examples to date of AI being used to execute a ransomware campaign, adding credence to concerns that AI capabilities could outpace cyber defenses.
According to the researchers, the AI agent was able to navigate the victim's environment independently, make decisions, and adapt its actions as the attack progressed. While the campaign relied on known vulnerabilities rather than previously undiscovered exploits, it highlights how AI could significantly lower the barrier to launching sophisticated cyberattacks.
How the Attack Unfolded
The campaign, dubbed JadePuffer, began after attackers exploited CVE-2025-3248, a critical authentication vulnerability in Langflow, an open-source framework used to build LLM applications. The flaw allowed arbitrary Python code execution on internet-exposed instances, giving the attackers an entry point into the compromised environment.
Once inside, the AI agent carried out reconnaissance, searching for valuable assets, including API keys, cloud credentials, cryptocurrency wallets, configuration files, and database credentials. It then dumped Langflow's Postgres database, scanned internal systems, established persistence, and later pivoted to a production server hosting both a MySQL database and the Nacos configuration platform. Ultimately, the attack encrypted 1,342 Nacos service configuration items before generating a ransom demand.
Researchers observed the AI adapting its behavior throughout the intrusion. It corrected failed actions, interpreted free-text information presented by the target environment, adjusted its approach to bypass authentication checks, and generated natural-language commentary explaining many of its actions as it progressed through the attack.
"The JadePuffer incident is significant not only because it is surprising but because it is a now documented example of something security researchers have been describing theoretically for two years," said Roey Eliyahu, CEO and Co-founder of Salt Security.
"Now there is a real case with a timeline, a CVE, and a 31-second autonomous self-correction loop. The narration of targeting rationale while destroying database schemas is interesting because it suggests the agent was not operating blind. It was reasoning about what it was doing."
The attack raises understandable concerns for enterprises. An AI agent capable of independently progressing through multiple stages of an intrusion could significantly reduce the expertise required to conduct sophisticated ransomware campaigns, potentially increasing both the speed and volume of future attacks.
Enterprises Can Breathe a Sigh of Relief for Now
Despite early reports describing the operation as fully autonomous, Sysdig has since clarified that a human operator remained involved in key stages of the campaign. While the AI handled the technical execution of the intrusion, it was not responsible for initiating every aspect of the attack.
