Cloud security firm Sysdig last week reported what it called the first documented case of “agentic” ransomware. The extortion campaign, dubbed JadePuffer, involved an AI agent that carried out the technical steps of a real-world attack from start to finish — breaking into a vulnerable server, stealing credentials, moving through the target network, encrypting files and composing its own ransom note.
Human role behind the scenes
Early coverage described the operation as running “without any human oversight” and with “no human at the keyboard.” Michael Clark, Sysdig’s senior director of threat research, clarified in a Monday interview with CyberScoop that a human was indeed involved, though not in the technical execution.
According to Clark, a human operator set up and pointed the operation, provisioned infrastructure such as the command-and-control server and a staging server for stolen data, and selected the victim. The credentials used to access the victim’s database were not harvested by the AI agent itself; they had been obtained in a prior compromise and provided to the operation.
Technical details of the intrusion
Sysdig’s account states the agent gained access via a known vulnerability in Langflow, an open-source tool commonly used to build LLM applications. The agent then moved to a production MySQL server and exploited another known flaw to obtain admin access. It encrypted over 1,300 configuration records, left a ransom note it wrote itself, and published a Bitcoin address for payment. Sysdig has not disclosed the identity of the targeted organization.
While the techniques used were fairly ordinary, the operation stood out for its speed and the transparency of the agent’s reasoning: the agent fixed a failed login in 31 seconds and annotated its actions with natural-language code comments as it proceeded.
Stolen provider keys vs. model identification
Clark initially said Sysdig found “multiple models were used in the attack” and cited harvested keys for OpenAI, Anthropic, DeepSeek and Gemini. He later clarified that those provider keys were part of the loot the agent collected, not evidence that several models actively powered different stages of the breach.
“The agent swept the Langflow host for anything valuable — provider API keys, cloud credentials, cryptocurrency wallets, and database configs — and those provider keys were part of the loot,” Clark wrote. They indicate what the attacker valued, but they don’t reveal which model made the operational decisions.
Sysdig was not able to identify the specific model driving JadePuffer and has no visibility into the agent’s system prompt or configuration.
Theories and future risk
Microsoft researcher Geoff McDonald suggested on LinkedIn that an open-weight model with safety training removed — rather than a frontier model — might have been used, based on his red-teaming experience that frontier labs’ safety layers generally hold up. Sysdig’s reporting neither confirms nor rules out that possibility.
McDonald also warned that if AI agents handle technical execution, the scale of ransomware campaigns could be limited more by attacker budget than by human effort, potentially enabling “thousands or tens of thousands of simultaneous campaigns.” Clark’s clarification that humans still provision infrastructure and supply credentials suggests those steps could remain bottlenecks for now.
Either way, Clark told CyberScoop that while Sysdig has not yet observed the exact same operation hitting other victims, the low cost of running an agent makes it likely similar incidents will increase.
Why this matters
JadePuffer demonstrates a scenario in which an AI can complete the full technical kill chain of a ransomware attack — from exploitation to encryption — and adapt like a human operator to obstacles. At the same time, the case highlights that “fully automated” attacks often still rely on human support for tasks such as providing infrastructure and initial access, at least in the documented instance.
