AI Agent Executes Ransomware Attack Autonomously: Jadepuffer

An autonomous artificial intelligence agent has successfully executed a ransomware attack without any human help. This marks what researchers describe as the first agentic ransomware attack of its kind. The AI agent exploited vulnerabilities, stole credentials, and encrypted a production database entirely on its own. Cloud security firm Sysdig attributes the attack to a threat actor it tracks as Jadepuffer. Researchers say this incident shows large language models can autonomously handle the full ransomware process, including reconnaissance, credential theft, and data encryption. The attack began by exploiting a critical authentication bypass vulnerability in Langflow's code validation endpoint. After gaining access, Jadepuffer searched for cloud credentials and other sensitive information. It then moved to a separate production server, exploited another vulnerability, and injected a backdoor administrator account. The ransomware encrypted 1,342 Nacos configuration records and replaced them with a ransom note demanding Bitcoin. Sysdig noted that the AI agent even adapted when an attempt to create an administrator account failed, generating a working alternative within 31 seconds. This event highlights the growing sophistication of AI in cyberthreats.