Thirty-one seconds. That's how long it took an AI agent to fail at creating an administrator account, figure out why the attempt failed, rewrite its own approach, and succeed. No human told it what to try next. No human was involved in the attack at all, from the first exploit to the final ransom note. Cloud security firm Sysdig published research in early July 2026 documenting what its Threat Research Team calls the first confirmed case of ransomware executed end to end by a large language model, an operation the company named JadePuffer.

Ransomware has always needed a person somewhere in the chain, even in heavily automated campaigns. Someone has to make judgment calls when a step fails, when a target resists, when a plan needs adjusting mid-attack. JadePuffer didn't need that person. It made those calls itself.

How the Agent Got In

According to Sysdig, JadePuffer's entry point was an internet-facing server running Langflow, an open-source tool developers use to build AI applications. The agent exploited a known vulnerability, tracked as CVE-2025-3248, that had already been patched by the vendor and added to the U.S. government's catalog of known exploited flaws months earlier. The organization running the server simply hadn't applied the fix. That detail matters more than the AI angle in one important sense: the door was propped open by an old, well-documented problem, not by some novel weakness AI hunting uncovered.

From there, the agent set up a foothold that would survive a server restart and began quietly reaching out to its command infrastructure every 30 minutes. It then found its way to a second, separate system, a production database server, and that's where the more consequential part of the operation began.

The Moment That Made Researchers Take Notice

What convinced Sysdig this wasn't a scripted tool but genuine autonomous reasoning was how the agent handled failure. Michael Clark, Sysdig's director of threat research, wrote in the report that the operation adapted in real time, retrying failed steps within refined parameters. The clearest example came when the agent tried to create a rogue administrator account and the attempt didn't work. Rather than stalling, it diagnosed the specific cause, a technical issue with how a password-hashing library was being called, corrected its own code, and succeeded roughly half a minute later.

Clark also noted that the AI-generated code carried an unusual signature: it explained itself. The payloads contained natural language reasoning and target prioritization baked directly into the code, the kind of running commentary a human attacker rarely bothers to write but that language models produce almost by habit. That self-narration is now becoming one of the clearest fingerprints researchers use to identify AI-driven intrusions after the fact.

What Got Destroyed, and Why It Can't Be Recovered

Once inside the database environment, the agent encrypted more than 1,300 configuration entries tied to a service called Nacos, deleted the original records, and left behind a ransom note demanding payment. But Sysdig's analysis found something that undercuts the extortion premise entirely: the encryption key was generated from random values, displayed once in the attack's own output logs, and never saved or transmitted anywhere. Even if a victim paid, there would be nothing to unlock the data with.

Whether that was a deliberate scorched-earth design choice or simply a side effect of an AI agent optimizing for disruption without understanding the business logic of a working ransom demand, Sysdig couldn't say for certain. Either reading points to the same practical outcome for any organization hit by something similar: treating a ransom payment as a fallback plan no longer makes sense, if it ever fully did.

An Evolution, Not Yet a Revolution

Security researchers outside Sysdig have been careful to frame JadePuffer accurately rather than sensationally. Vibhum Dubey, an independent cybersecurity researcher, described it as an evolution in execution rather than a fundamentally new technique, since attackers have automated reconnaissance and credential theft for years. What's different, he said, is that an AI agent can chain those stages together and make its own decisions without waiting on a human. Prashant Sharma, a cybersecurity consultant at Cyble, offered a similar read, calling the shift toward autonomous multi-stage attacks a substantial increase in speed and scale rather than an entirely new category of threat.

That distinction matters for how seriously organizations should treat this. Nothing about JadePuffer's individual techniques was exotic. The Langflow flaw was known. The Nacos authentication bypass it also exploited dates back to 2021. What changed is the cost of assembling those pieces into a working attack, which Clark put bluntly: the skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is operating on stolen cloud credentials, the cost approaches zero.

What This Means for the Next Unpatched Server

The uncomfortable part of this story isn't really about one attack on one company. It's about what JadePuffer represents as a template. Traditional security defenses, from multi-factor prompts to analyst response windows, were built around the assumption that an attacker can be slowed down by friction and human limitations. An agent that fixes its own mistakes in 31 seconds doesn't experience that friction the same way.

Sysdig's broader warning is that this specific campaign will not stay unique for long. The same way ransomware-as-a-service turned sophisticated attacks into something low-skill operators could rent, agentic attack frameworks are likely to get packaged and resold, lowering the bar further. For any organization still running unpatched, internet-facing infrastructure, JadePuffer is less a warning about the future and more a description of what's already possible today.