AI agent conducts first fully autonomous ransomware attack

Security researchers have documented what they assess to be the first fully autonomous ransomware operation, executed from initial intrusion to data destruction by an artificial intelligence agent without human guidance during the attack. The threat actor, dubbed JADEPUFFER by Sysdig’s Threat Research Team, exploited a known vulnerability in an exposed server, moved laterally to a production database, and encrypted critical configuration data.

The operation began when the AI agent gained access to an internet-facing server running Langflow, an open-source framework for building AI applications, by exploiting a critical vulnerability tracked as CVE-2025-3248. This flaw, which allows unauthenticated remote code execution, was patched in May 2025, but many systems remain unupdated. Once inside, the agent systematically harvested a wide array of credentials, including API keys for major AI providers and cloud services, cryptocurrency wallet information, and database logins. It also installed a persistent backdoor to beacon to a command-and-control server every 30 minutes.

The Langflow server was not the primary target. Using the stolen credentials, the agent pivoted to a separate,...