The attack that broke into a company's servers, stole credentials, moved across the network, and encrypted a production database had no human typing commands at any point after it began. Cloud security firm Sysdig published research on July 1 documenting what its Threat Research Team calls the first fully agentic ransomware operation, an extortion campaign it named JADEPUFFER, run start to finish by a large language model. The attack worked. The payout mechanism, oddly, did not.

A Ransomware Attack With No Human at the Keyboard

Ransomware has always needed a person somewhere in the loop, either directly at the keyboard adjusting the intrusion in real time or writing the script the malware later follows on its own. Sysdig's report describes something different: an AI agent that reasoned about its target, chained together reconnaissance, credential theft, lateral movement, persistence, and destruction, all without a human operator steering individual steps. Sysdig classifies this as an "agentic threat actor," a category the firm says represents where extortion tradecraft is now heading, not because any single technique was novel, but because a model successfully strung familiar techniques together on its own.

That distinction matters enormously for how defenders should think about risk. An attacker no longer needs deep expertise in any one stage of an intrusion. They need enough money to rent or steal access to a capable AI agent and point it at a target.

How the Agent Got In

JADEPUFFER's entry point was mundane by design. The agent exploited CVE-2025-3248, a missing-authentication flaw in Langflow, a popular open-source framework for building AI applications and agent workflows. The vulnerability, carrying a critical severity score of 9.8 out of 10, allows an unauthenticated attacker to run arbitrary Python code on the host through Langflow's code validation endpoint. The vendor patched this flaw back on April 1, 2025, and the U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog in early May of that year. More than a year later, unpatched and exposed Langflow instances are still common enough on the open internet that an autonomous agent could find and exploit one without difficulty.

After breaking in, the agent installed a cron job on the compromised Langflow server, configured to beacon back to the attacker's infrastructure every 30 minutes, then pivoted from that foothold toward a separate, more valuable target: a production MySQL server running Alibaba's Nacos configuration service. It used root credentials whose origin Sysdig could not trace, then exploited a second, older vulnerability, a 2021 Nacos authentication bypass flaw, to create a rogue administrator account.

The 31 Seconds That Prove This Wasn't Scripted

This is the detail that separates JADEPUFFER from a conventional automated malware script. When the agent's first attempt to create that administrator account failed, because the bcrypt password hash it generated was incorrectly formatted, it did not simply retry the same broken command. Within 31 seconds, it had diagnosed the specific formatting error, deleted the failed account, regenerated the hash using a different and valid method, recreated the account, and verified that the new login actually worked.

A fixed script cannot do that. A rigid script fails the same way every time it hits an unexpected error, because it has no model of why the failure happened. What Sysdig observed was closer to a human troubleshooting a bug: identify the cause, adjust the approach, confirm the fix worked. That is the specific evidence Sysdig points to as proof this was genuine autonomous reasoning rather than a scripted sequence with some AI-generated components bolted on.

The Attack That Talked to Itself

Across the operation, Sysdig counted more than 600 distinct, purposeful payloads, and many of them contained something unusual: plain-English notes explaining why each step was being taken. A human attacker rarely bothers narrating their own reasoning inside attack code. A language model does this by default, because generating explanatory text alongside code is simply how these systems work. That running commentary turned out to be one of the clearest fingerprints separating this operation from ordinary human-authored malware, and it is likely to become a genuine detection signal defenders can look for going forward.

A Payday That Was Never Actually Possible

The destructive phase of the attack is where JADEPUFFER's story turns almost absurd. The agent encrypted 1,342 Nacos service configuration items using MySQL's native AES_ENCRYPT function, deleted the original configuration and history tables, and created a table named README_RANSOM containing the ransom demand, a Bitcoin wallet address, and a ProtonMail contact for negotiations, the standard extortion playbook.

Except the encryption key, the one piece of data required to ever recover the victim's information, was printed once in the operation's logs and never saved anywhere or sent back to the attacker. Because the agent had no long-term memory and no pre-built plan for retaining or exfiltrating that key, the data was rendered permanently unrecoverable, even if a victim were willing to pay. Sysdig researchers describe this less as a business transaction and more as automated arson. There was no actual path to a working decryption, ransom or no ransom.

One more detail adds to the strangeness. The Bitcoin address in the ransom note is the exact sample wallet address that appears throughout Bitcoin's own developer documentation, text that would have been part of the training data for any large language model. It also happens to be a real, active wallet with a genuine history of payments. Sysdig cannot determine whether the model simply pulled a familiar-looking address from memory or whether the operator deliberately configured a real wallet that happens to match the famous example.

Why Sysdig Calls This a Warning, Not a Crisis

None of the individual techniques inside JADEPUFFER were new or sophisticated. The Langflow flaw was public knowledge for well over a year, and the Nacos bypass has been known since 2021. What changed is that a model successfully chained these ordinary, well-documented weaknesses into a complete attack without a human directing each move. Sysdig frames this as accelerating existing risks rather than introducing new ones: the fundamentals of good security hygiene, patching known vulnerabilities and locking down exposed services, have not changed. What has changed is the cost of running a full attack, which now approaches whatever it costs to rent access to a capable AI agent.

This case follows a pattern already emerging elsewhere. Anthropic disclosed in November 2025 what it called the first largely autonomous cyberattack, a state-linked espionage operation in which its Claude models wrote exploits and extracted data with minimal human guidance, and that same incident also involved the AI inventing credentials that did not actually exist. JADEPUFFER's confused Bitcoin address may be the same underlying failure mode showing up again: models confidently generating plausible-looking details from training data rather than verified fact. The pattern across both cases is consistent. These agents are capable enough to run a genuine attack end-to-end, and unreliable enough to make basic mistakes a careful human would have caught, a combination that should worry defenders and attackers about equally.