Cloud security firm Sysdig revealed last week that the world’s first “agentic ransomware” attack, dubbed JadePuffer, was executed autonomously by an AI agent on a vulnerable server, though researchers have now clarified that human hackers still orchestrated the campaign behind the scenes.
The extortion operation saw an artificial intelligence agent handle the entire technical execution of a real-world cyberattack from start to finish. The digital agent breached a vulnerable system, harvested credentials, navigated the target’s internal network, encrypted critical files, and drafted its own ransom note. It adapted to system obstacles dynamically, mimicking a skilled human hacker. Initial reports characterised the operation as running entirely without human oversight or direct manual intervention.
The human bottleneck behind the bot
However, that narrative does not capture the full picture. In an interview with CyberScoop, Michael Clark, Sysdig’s senior director of threat research, clarified that a human operator was heavily involved in the preparatory stages. “A human still set up and pointed the operation and provisioned the infrastructure behind it, the command-and-control server, the staging server used for the stolen data and chose a victim,” Clark explained. Furthermore, the database credentials used to gain initial access were not harvested by the AI itself, but were obtained beforehand via a separate compromise and fed to the agent.
Technical execution and speed
Despite the human preparation, the technical capabilities demonstrated by the AI agent remain remarkable. The bot gained entry by exploiting a known vulnerability in Langflow, a popular open-source tool used for building Large Language Model (LLM) applications. From there, it pivoted to a production MySQL server, exploiting another security flaw to secure administrator privileges. The agent then encrypted more than 1,300 configuration records, leaving a self-written ransom note demanding Bitcoin. Sysdig has not disclosed the identity of the victim.
While the hacking techniques themselves were relatively standard, the speed and transparency of the execution stood out. The AI agent resolved a failed login attempt in just 31 seconds, documenting its logical reasoning in natural-language code comments as it proceeded.
The mystery of the stolen API keys
Initial confusion arose regarding the specific AI models driving the attack. Clark previously noted that Sysdig discovered harvested API keys for OpenAI, Anthropic, DeepSeek, and Gemini, sparking questions about whether multiple models were powering different phases of the intrusion. Clark later clarified to TechCrunch that these keys were merely part of the stolen data rather than the engine behind the attack.
“The agent swept the Langflow host for anything valuable — provider API keys, cloud credentials, cryptocurrency wallets, and database configs — and those provider keys were part of the loot,” Clark stated. “They are indicative of what the attacker considered worth taking, but they do not tell us which model was making the decisions.” Sysdig was unable to identify the specific model driving JadePuffer, as they lacked visibility into its system prompt or configuration.
var playerInstance_jwplayer_6a7a0898abf30 = jwplayer( “jwplayer_6a7a0898abf30” );
playerInstance_jwplayer_6a7a0898abf30.setup({
playlist: “https://cdn.jwplayer.com/v2/media/lv0GaEwB”,
});
The future of automated cyber threats
Geoff McDonald, a researcher at Microsoft, shared a theory on LinkedIn suggesting that an open-weight model with safety guardrails stripped out, rather than a mainstream commercial model, likely powered the attack. McDonald noted that commercial safety layers generally withstand such manipulation well, a theory Sysdig’s findings neither confirm nor disprove.
McDonald also warned that the scale of future ransomware campaigns may soon be limited only by an attacker’s budget rather than human labour, potentially enabling thousands of simultaneous attacks. However, this concern is slightly mitigated by Clark’s confirmation that humans must still perform the initial setup, target selection, and credential gathering for each operation. Nevertheless, given the low cost of running autonomous agents, Sysdig expects to see similar operations targeting more victims in the near future.