Sysdig’s Threat Research Team documented what it says is the first fully AI-agent-driven ransomware operation, an intruder it named JADEPUFFER, in a report published July 1, 2026. The agent exploited CVE-2025-3248, a Langflow remote-code-execution flaw, to harvest cloud and LLM-provider credentials, then used a 2021 authentication bypass to compromise a separate production MySQL/Alibaba Nacos server, encrypting 1,342 configuration items and leaving a ransom note whose key was never saved, making recovery impossible even with payment. Sysdig’s strongest evidence of autonomy: when an admin-account login failed, the agent diagnosed the cause and issued a working fix in just 31 seconds, and more than 600 payloads across the operation carried plain-language comments explaining the agent’s own reasoning. Security researchers say the incident is less about a novel exploit and more a warning that unpatched software, default credentials, and internet-exposed database admin accounts are now targets an autonomous agent can chain together without a skilled human operator.
