Researchers say an autonomous artificial intelligence agent carried out what they describe as the first agentic ransomware attack, completing a full intrusion chain without human intervention. The report says the attack involved exploiting vulnerabilities, stealing credentials and encrypting a production database.
What happened
According to the report, cloud security firm Sysdig attributed the activity to a threat actor it tracks as Jadepuffer. The intrusion began with exploitation of CVE-2025-3248, a critical authentication bypass vulnerability in Langflow’s code validation endpoint. Langflow is an open-source framework used to build AI applications and agent workflows.
After gaining access, the agent reportedly searched the environment for cloud credentials, API keys, cryptocurrency wallets, configuration files and database secrets. Sysdig said it dumped Langflow’s PostgreSQL database to collect stored credentials, scanned internal networks and accessed an exposed MinIO object storage service using default credentials.
Researchers also said the agent established persistence with a cron job that beaconed to attacker-controlled infrastructure every 30 minutes. It then moved to an internet-exposed production server running MySQL and Alibaba’s Nacos configuration platform, exploiting CVE-2021-29441, abusing Nacos’ default JWT signing key and injecting a backdoor administrator account before the extortion phase.
Why it matters
The reported incident is notable because it suggests that large language models can be used to carry out a complete ransomware lifecycle, including reconnaissance, credential theft, lateral movement, privilege escalation and data encryption. The report also notes that the attack did not rely on zero-day vulnerabilities or novel techniques; instead, it combined known weaknesses, exposed services and default credentials into an automated chain.
The article also places the incident in the context of broader warnings from the Five Eyes alliance, which said in June that AI is accelerating the speed, scale and sophistication of cyberthreats.
What to watch
Preparedness-minded teams may want to pay attention to systems exposed to the internet, default credentials, unpatched vulnerabilities and weak secrets management. The report says Sysdig found hundreds of payloads containing natural-language reasoning and self-generated annotations, suggesting the agent adapted during the intrusion when one attempt to create an administrator account failed.
Sysdig also said it found no evidence that the attackers retained a decryption key or backup of the encrypted data, which would leave victims with limited recovery options if confirmed.
