Meet JADEPUFFER: The First Ransomware Attack Run Entirely by an AI Agent

For as long as ransomware has existed, there’s been a person behind it someone typing commands, adapting on the fly when something breaks, or at minium writing the script the malware runs. That assumption just took a hit.

Security researchers at Sysdig say they’ve documented the first ransomware operation carried out start to finish by an AI agent, with no human at the keyboard during the actual attack. They’re calling the operator JADEPUFFER, and the case is being treated as a preview of where cybercrime is headed now that AI agents can act on their own.

How it got in

JADEPUFFER’s entry point wasn’t exotic. The agent exploited a known, already-patched vulnerability in Langflow, an open-source framework developers use to build AI applications the kind of flaw that should have been closed off, except the server was still exposed to the internet. From there, the agent harvested credentials, pivoted to a separate production server, and began working its way toward a MySQL database sitting behind Alibaba’s Nacos configuration service.

What made it different from a normal attack

Typical ransomware runs on a fixed script. JADEPUFFER behaved more like an adaptive operator. When one login attempt failed, researchers observed the agent diagnose the problem, rewrite its approach, and succeed roughly 30 seconds later, a turnaround that’s hard to explain as anything but automated reasoning happening in near real time. When a database command failed silently, the next attempt came back with a fix tailored specifically to that failure, not a generic retry.

The clearest fingerprint, though, was in the payloads themselves. According to Sysdig’s report, the code was full of natural-language comments explaining why each step was being taken which targets looked most valuable, what the next move should be. That kind of running commentary isn’t something human ransomware operators typically bother writing into disposable scripts, but it’s a familiar byproduct of how AI coding tools generate output.

The damage and a strange twist

Once inside, the agent encrypted over 1,300 configuration entries, deleted the originals, and dropped a ransom note demanding payment. But there was a catch that undercuts the “extortion” framing: the encryption key appears to have been generated randomly and never sent anywhere the attacker could retrieve it later. In other words, paying the ransom likely wouldn’t have restored anything. What looked like a shakedown may have functionally been a data-destruction event with a ransom note bolted on.

Why this matters beyond one incident

Security researchers are careful to note that JADEPUFFER didn’t rely on any groundbreaking new exploit every technique it used was already known. That’s arguably the more unsettling part. The barrier to running a full-lifecycle attack reconnaissance, credential theft, lateral movement, persistence, destruction no longer requires an operator who’s skilled at any single one of those steps. It just requires renting the right agent and pointing it at an exposed target.

For organizations, the practical guidance hasn’t really changed: patch known vulnerabilities promptly, don’t expose admin services to the internet, keep credentials out of environments a compromised server can read, and treat unpatched software as something a machine will now probe automatically rather than an occasional human threat. What has changed is the timeline. The gap between a vulnerability going public and it being weaponized against you is shrinking to hours, not months.

JADEPUFFER is the latest sign that AI agents are becoming as useful to attackers as they are to defenders. Expect this to be the first of many such cases, not the last.