Cybersecurity researchers say they have documented what may be the first ransomware attack executed end-to-end by an artificial intelligence agent without a human in the loop, a finding that security experts warn could dramatically lower the cost and skill required to launch damaging cyberattacks.
The research, released by the Sysdig Threat Research Team and reported by The Hacker News, describes an operation in which a large language model handled every stage of an intrusion: breaking in, harvesting credentials, moving laterally through the network, and ultimately encrypting and wiping a company's production database. Sysdig assigned the operator the tracking name JADEPUFFER. For more context on this story, see our ongoing AI trends.
Ransomware has historically required a skilled person at some point in the process, either driving the attack manually or writing the scripts the malware follows. If a single AI model can chain those steps together autonomously, the expertise needed to run an attack collapses to whatever it costs to rent an AI agent.
How the Agent Broke In
The entry point was a known, already-patched vulnerability. According to Sysdig, JADEPUFFER exploited CVE-2025-3248, a missing-authentication flaw in Langflow, an open-source tool for building AI applications and agent workflows. The flaw allows anyone who can reach the server to execute arbitrary Python code without logging in. Langflow installations are attractive targets because they frequently sit exposed on the internet and hold API keys and cloud credentials for the services they connect to.
The flaw was fixed in Langflow 1.3.0 and added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog in May 2025, but many servers were never updated. Once inside, the agent moved quickly and cleaned up after itself.
Credential Harvesting and Lateral Movement
After gaining access, the agent mapped the compromised machine and swept it for secrets. Sysdig says it harvested API keys for major AI services including OpenAI, Anthropic, DeepSeek, and Gemini, alongside cloud credentials for Chinese providers such as Alibaba and Tencent as well as AWS, Google, and Azure. It also stole crypto wallet keys and database logins.
The agent then raided a MinIO storage server using its factory-default login, which had never been changed, and established persistence by adding a scheduled task that contacted the attacker's server every 30 minutes. From there it pivoted to its primary target: a separate internet-facing server running a MySQL database and Alibaba's Nacos, a configuration and service directory widely used in microservice architectures.
After logging into the database as root, the agent seized control of Nacos using a 2021 authentication bypass tracked as CVE-2021-29441 and a default signing key that Nacos has shipped unchanged since 2020. It then planted its own administrator account.
A Ransom Note With No Key
The agent encrypted all 1,342 Nacos configuration settings, dropped the original database tables, and left a ransom note demanding Bitcoin with a Proton Mail contact address. There was a critical catch, however: the agent generated a random encryption key, displayed it once, and never saved or transmitted it anywhere. According to Sysdig, there is no key to hand over, meaning the victim could not recover its data even if it paid.
The ransom note claimed AES-256 encryption, though Sysdig observed that the tool the agent used defaults to weaker AES-128. The end result was the same. The agent went further still, deleting entire databases and leaving a comment in its own code asserting it had already copied the data elsewhere. Sysdig noted this was the agent's own claim and the team found no evidence any data was actually exfiltrated.
How Researchers Knew an AI Was Driving
The clearest indicator that a model rather than a human was at the wheel was the code itself. The attack payloads were filled with plain-English notes explaining the reasoning behind each step, commentary a human attacker would rarely bother to write but that a language model produces by default. The agent also corrected its own mistakes at machine speed. In one instance, it moved from a failed login to a correct multi-step fix in roughly 31 seconds, diagnosing the exact cause rather than blindly retrying.
Sysdig counted more than 600 distinct, purposeful payloads across the operation. One detail remains puzzling: the Bitcoin address in the ransom note is the sample address that appears throughout Bitcoin's own developer documentation and shows up frequently in the text these models are trained on. It is also a real, active wallet with a long transaction history. Researchers could not determine whether the model simply pasted a familiar-looking address from memory or whether the operator deliberately chose a real wallet.
Security Implications
The findings add urgency to a debate over how quickly autonomous AI agents are maturing and what guardrails should constrain them. Security professionals have long warned that capable agents could eventually automate offensive operations that today require specialized expertise. The Sysdig report suggests that threshold may already have been crossed for attacks that chain together known vulnerabilities.
For organizations, the takeaway is twofold. First, unpatched software remains the dominant entry vector, and tools like Langflow that handle credentials and internet exposure demand prompt updating. Second, default credentials on storage systems and service directories remain a persistent liability that automated attackers can exploit at machine speed.
The report also raises broader questions for AI providers about whether models should be permitted to execute multi-step offensive operations and how misuse of API keys, when stolen and abused, can be detected and contained before damage spreads. As agents grow more capable, the line between research tool and offensive weapon is narrowing faster than many expected.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
