JadePuffer: AI Agent Automates Entire Ransomware Attack

Ransomware operation JadePuffer has been identified as the first documented case of an attack conducted entirely by an AI agent. This autonomous AI agent performed reconnaissance, stole credentials, moved laterally within systems, and encrypted data. What's interesting is how the AI agent adapted to challenges, much like a human operator. It even retried failed steps with refined parameters, fixing a login issue in just 31 seconds. JadePuffer gained initial access by exploiting a vulnerability in Langflow, an open-source framework for building AI apps. After gaining access, the AI agent dumped databases, collected host information, and retrieved credentials. It also showed an adaptive approach when enumerating a MinIO object store, adjusting its parsing logic when an API request returned XML instead of JSON. The agent established persistence by installing a cron job and then pivoted to a production MySQL server. It deployed the ransomware payload, encrypting over a thousand Nacos service configuration items before deleting the originals. The ransom note demanded Bitcoin, but researchers believe the encryption used was weaker than claimed. The encryption key was randomly generated and not stored or transmitted to the attacker. This development shows the evolving sophistication of cyber threats, powered by AI.