Cloud security firm Sysdig says it has documented what it calls the first known case of “agentic ransomware,” but the attack was not fully human-free. The operation, tracked as JadePuffer, used an AI agent to carry out the technical stages of a real-world cyberattack, while a human still selected the victim, prepared the infrastructure and supplied stolen credentials.
Sysdig’s report said the AI agent handled the intrusion after the operation was launched. It broke into a vulnerable server, moved through the target environment, stole data, encrypted files and wrote a ransom note with payment instructions.
The clarification matters because early descriptions of the attack suggested there was no human oversight at all. Sysdig senior director of threat research Michael Clark later told CyberScoop that a person still set up the command-and-control server, staging server and victim targeting before the agent took over.
Agent Exploited Known Vulnerabilities
JadePuffer gained initial access by exploiting a known flaw in Langflow, an open-source tool used to build AI applications and agent workflows. The agent then moved into a production MySQL server and exploited another known issue to gain administrator access.
Sysdig said the agent encrypted more than 1,300 configuration records and left behind a ransom note it generated itself. The note included a Bitcoin address for payment.
The attack techniques were not especially new, but the execution was unusual. Sysdig said the agent adapted during the operation and corrected a failed login attempt in 31 seconds, leaving natural-language comments that showed its reasoning.
The company has not identified the victim or disclosed the country where the attack took place. It also has not confirmed which AI model powered the agent.
Stolen AI Keys Were Part of the Loot
Clark also clarified that API keys for OpenAI, Anthropic, DeepSeek and Gemini found during the attack were stolen data, not evidence that those models were used to run JadePuffer. He said the agent swept the Langflow host for valuable material, including provider keys, cloud credentials, cryptocurrency wallets and database configurations.
That means the stolen keys show what the attacker considered useful, but not which model made the decisions. Sysdig said it did not have visibility into the system prompt or configuration behind the agent.
Microsoft researcher Geoff McDonald has suggested that the attack may have used an open-weight model with safety training removed rather than a frontier commercial model. Sysdig’s findings do not confirm or rule out that theory.
The case still raises concerns about how cheap and scalable ransomware operations could become when AI agents handle technical execution. However, the human setup described by Sysdig suggests attackers still face bottlenecks, including choosing targets, obtaining credentials and preparing infrastructure.
Featured image credits: Magnifc.com
For more stories like it, click the +Follow button at the top of this page to follow us.