Sysdig documented the first ransomware attack run end to end by an AI agent, no human at the keyboard.
The agent fixed its own failed login in 31 seconds and ran over 600 payloads on its own.
Researchers warn the skill needed to run ransomware has now dropped to whatever it costs to rent an agent.
Cybersecurity has been waiting for this moment, and it finally arrived. Sysdig published research on JadePuffer, an AI agent that completed the entire intrusion chain, from initial access to database extortion, using an LLM to adapt its actions and execute more than 600 coordinated payloads. This is not AI helping a hacker. This is the AI doing the hacking.
How the attack actually worked
The break-in was almost boring. JADEPUFFER exploited CVE-2025-3248, a missing-authentication flaw in Langflow, an open-source tool for building AI apps, that lets anyone who can reach the server run their own Python code, no login needed. From there it pivoted to the real target, a production database server.
The scary part was the behavior. The decoded payloads were saturated with natural-language commentary explaining why each action was taken, including which database was the “largest” and worth hitting first. Human hackers do not annotate their throwaway code like this.
LLMs do it by default. And when a step failed, the agent fixed itself fast. Sysdig’s logs show the agent diagnosing a broken backdoor login, deleting it, regenerating a working password hash, and confirming success in 31 seconds without human intervention.
Watch Sysdig’s own breakdown here:
https://www.youtube.com/watch?v=M3s0uPlnUzQ
Why this matters for your site
The lesson is not that some genius new technique appeared. It is the opposite. None of the individual techniques were novel or sophisticated, but an AI model strung them together into a complete ransomware operation against neglected internet-facing infrastructure. The threat targets what you already forgot to patch.
Here is the line every site owner should read twice. “The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero,” said Michael Clark, Senior Director of Threat Research at Sysdig.
The fixes are old-school and boring, which is good news. Patch Langflow and never expose its code-running endpoints to the web. Keep API keys and cloud secrets out of any tool the internet can reach.
Change default signing keys, and never let a database admin account face the open internet. Sysdig expects the volume and breadth of such campaigns to rise as agentic tooling matures. Treat every exposed server as something a machine will probe tonight, not just a person.
Quick Links: