AI Ransomware: First Autonomous Attack by JadePuffer

Security researchers have identified the first documented case of a ransomware attack planned and executed entirely by an autonomous AI agent. This marks a significant shift in the global cyber threat landscape. The attack group, known as JadePuffer, used a large language model to manage every stage of the campaign. This included initial intelligence gathering, credential theft, lateral movement, data encryption, and the ransom demand. The cloud security company Sysdig reported this finding. What's concerning is the AI agent's flexibility and ability to adapt in real time. It could identify failures in its own actions and quickly correct them. For example, the system encountered a login error, analyzed it, changed code parameters, and produced a working solution within 31 seconds. The initial breach exploited a known vulnerability, CVE-2025-3248, in Langflow, an open-source framework for building AI applications. The AI agent then scanned databases, extracted passwords, and encrypted 1,342 service configuration items. It left a ransom demand in Bitcoin. This development reflects a technological leap beyond previous AI-based attack tools, which mainly generated phishing content or wrote code for human operators. This move to fully autonomous agents allows complex attacks with far less technical skill from human attackers and at a much faster pace. This could make it harder for human defenders to keep up.