AI Ransomware Went Autonomous. Is Your Business Ready?

Security researchers at Sysdig published the first documented case of a ransomware attack run entirely by an artificial intelligence agent, with no human operator directing it after setup. The campaign, which Sysdig calls JadePuffer, broke into an exposed AI development server, pivoted to a production database, and ran the entire extortion playbook itself: reconnaissance, credential theft, lateral movement, encryption, and a ransom note. The vulnerability it used to get in had been publicly known and patched for over a year. That detail matters more than the AI part.

What Actually Happened

Sysdig's Threat Research Team published its findings on July 1, 2026, and the story was picked up by Dark Reading and CSO Online within days. The attacker, dubbed JadePuffer, exploited CVE-2025-3248, a critical flaw in Langflow, an open source tool developers use to build AI applications. The flaw let anyone send a request to an unprotected part of Langflow and run their own code on the server. No login required.

From there, the AI agent did the rest on its own. It scanned the compromised machine for API keys and cloud credentials, found a more valuable second target (a production server running a MySQL database and a configuration service called Nacos), and pivoted to it. It exploited an old authentication bypass in Nacos from 2021, forged a login token using a default signing key the vendor never expects anyone to still be using, and got in.

Once inside, it encrypted more than 1,300 configuration records, deleted the originals, and left a ransom note with a Bitcoin address and an email contact. Sysdig counted more than 600 separate, purposeful commands across the operation, and it set up persistence by beaconing out every 30 minutes. In one stretch, the agent tried a login, watched it fail, diagnosed the cause, and had a working fix ready in 31 seconds. Researchers described the code as "self-narrating," full of plain-language notes about what it was doing and why, the kind of commentary a human operator rarely bothers to write but that AI-generated code produces by default.

Why This Was Not a Zero-Day

None of this required a brand-new exploit. CVE-2025-3248 was reported by researchers in February 2025, patched by Langflow that March, and added to the federal government's Known Exploited Vulnerabilities catalog by May, after other attackers had already used it to install botnet malware. JadePuffer showed up more than a year after all of that, on infrastructure that never got the fix everyone already knew about. It is the same root cause behind most of the record-setting patch volume IT teams have been chasing all year: known problems that sit unresolved longer than anyone expects.

That is the part worth sitting with. The attack did not succeed because AI found some undiscovered flaw. It succeeded because a known, patched, publicly flagged vulnerability was still sitting exposed on the internet, and nobody had gotten around to updating it.

Sysdig's own writeup put it plainly: agents make it "effectively free" to spray every vulnerability ever cataloged against every system still exposed to it. The long list of old, unpatched software that used to be a low priority risk is a bigger one now, because checking for it no longer takes a skilled attacker's time. It takes a script and a few dollars of API usage.

The Speed Problem

Johan Edholm, co-founder of the security firm Detectify, made the point that stuck with us most. "A quarterly assessment can leave dangerous gaps when cloud infrastructure and internet-facing services change every day, while an automated attacker can move from discovery to impact in minutes."

Most IT reviews, even good ones, run on a calendar. Patch on Tuesdays. Review access quarterly. Audit vendors once a year. JadePuffer went from a failed login to a working exploit in half a minute, then kept working through the night without getting tired or distracted. A calendar cannot keep pace with that, and it was never built to. Coverage that runs continuously, the same logic behind why EDR has replaced plain antivirus for active threat detection, is the thing that can.

What It Means for a Business Not Running Langflow

Almost none of the businesses we talk to are running Langflow specifically. That is not really the point. The pattern is: a system got stood up fast for a project, someone meant to lock it down later, it stayed exposed, and it had a known vulnerability nobody tracked. That describes a lot more than one AI development tool. It describes the test server nobody decommissioned, the vendor portal still running its default password, the remote access tool a contractor installed two years ago and nobody removed.

Sysdig's team was careful to note that none of JadePuffer's individual techniques were new. Credential harvesting, lateral movement, database encryption: standard ransomware moves, similar to what we covered when ransomware groups started using AI coding tools to build better attack software earlier this summer. What changed with JadePuffer is that an AI agent chained the moves into a complete operation and ran it alone, at a pace and cost no human crew could match. The skill floor for running a ransomware operation has dropped to whatever it costs to run an agent. If that agent is running on stolen cloud credentials, the cost to the attacker gets close to zero.

Three Questions Worth Asking About Your Own Setup

Do you have a current list of every system your business exposes to the internet, including the ones set up for a single project two years ago and forgotten? Sysdig noted that Langflow servers are often "stood up quickly without network controls," a pattern that reaches well beyond AI tools into any fast-moving IT or vendor project.

When was the last time something other than laptops and core servers got checked for patch status? The vulnerability in this attack sat on a supporting service, not the primary target everyone thinks to protect first.

Who is actually watching for unusual activity in real time, instead of finding out at the next scheduled review? The gap between those two is exactly where JadePuffer operated, undetected, for as long as it needed.

Frequently Asked Questions

What is agentic ransomware?

Agentic ransomware is an attack where an AI agent, not a human operator, runs the entire intrusion and extortion process: breaking in, stealing credentials, moving through a network, and encrypting or destroying data. Sysdig's JadePuffer research, published in July 2026, is the first documented case that ran end to end without a human directing each step.

Is this the first AI-generated ransomware ever found?

It is the first confirmed case of a fully autonomous attack running against a real target. An earlier candidate called PromptLock, found in August 2025, turned out to be a research proof of concept built by university researchers, not a real attack in the wild.

My business does not use Langflow. Does this still matter?

Yes. The specific tool matters less than the pattern behind it: an internet-facing system with a known, already-patched vulnerability that nobody got around to applying. That describes far more systems than one AI development platform, including tools most growing businesses have running somewhere without realizing it.

How can a growing business defend against this kind of attack?

The fundamentals still hold up. Know what systems are exposed to the internet. Keep a real patch schedule for supporting services, not just core servers and laptops. Rotate default credentials instead of leaving vendor defaults in place. Have continuous monitoring rather than periodic reviews. None of that is exotic. It is the difference between catching a problem in minutes and finding it next quarter.

Will AI-driven attacks like this become more common?

Researchers who study this expect so. As the tooling to connect AI models to offensive scripts gets packaged and easier to reuse, less skilled attackers gain access to it. Criminal groups tend to adopt new tooling faster than legitimate organizations adopt new defenses, since they are not slowed down by procurement or compliance processes the way a business is.