First Fully Autonomous AI Ransomware Attack Documented by Sysdig’s Threat Team

Cloud security firm Sysdig has documented what appears to be the first ransomware operation carried out entirely by an autonomous AI agent. The operator, dubbed JADEPUFFER, was a large language model that scouted the target, stole credentials, moved through the network, and destroyed data without any human intervention.

The malware initially gained access through a vulnerability in Langflow, a free-to-use platform for developing artificial intelligence apps. It obtained API keys, cloud credentials, and database access logs before targeting a new production server hosting the Alibaba Nacos service and MySQL database using the same authentication bypass to proceed further.

JADEPUFFER encrypted all 1,342 items in the Nacos configurations, deleting them before creating a ransom note table called README_RANSOM. Despite its effectiveness, researchers noted several giveaways that a machine, not a human, was behind it. The malicious code contained polite, detailed natural-language comments explaining each step of its logic, and the encryption key used to lock the data had been created only once and printed out but nowhere saved or sent.

Furthermore, the Bitcoin address provided in the ransom note was a generic placeholder commonly found in open-source documentation, making the entire payment pointless. Sysdig claims that AI agents are reducing the necessary skill level for executing an entire attack chain from end-to-end, with the more concerning aspect being old, vulnerable software can now be easily exploited through an AI agent.