AI-Led Ransomware: JadePuffer's Autonomous Attack Unveiled

Researchers claim to have found the first documented ransomware attack led entirely by an autonomous AI agent. This attack, named JadePuffer, used a Large Language Model agent to scout targets, steal credentials, navigate networks, and lock data. What's interesting is how the AI handled problems. When initial attempts failed, it analyzed error messages and rewrote its own code in real time to bypass security. It adapted on the fly, moving through the target network quickly, fixing a failed login in just 31 seconds. In another case, it instantly adjusted its logic to read an unexpected data format. The AI gained access by exploiting a security flaw in an app called Langflow. It then stole cloud credentials and encrypted 1,342 Nacos service configuration items, leaving a ransom demand. Researchers identified the AI due to unusual "AI habits" in the code, like polite, natural-language comments and a "hallucination" where the AI provided a generic, unusable placeholder for the Bitcoin ransom address. This shows a new and evolving threat in cyber security.