Inside the First AI-Run Ransomware Attack

Editor’s Note

Hi,

 On July 1st, security firm Sysdig published research on an attack named JADEPUFFER, the first documented ransomware campaign an AI agent ran from start to finish.

A human picked the target. The agent broke in, stole credentials, moved through the network, destroyed a production database, and wrote its own ransom note, fixing a failed login in 31 seconds along the way.

Weeks later, it came back with a bigger, meaner payload built to destroy AI models specifically. The exposed server never got fixed.

Lavanya Chandrasekharan,
Siemba

TLDR

• The "AI" in this attack wasn't the hard part. CISA put the way in on its Known Exploited Vulnerabilities list on 5 May 2025 and gave federal agencies until 26 May to patch it. Fourteen months later the server was still exposed, and the same flaw had already been used to deploy the Flodrix botnet.
  
  

• The operator came back. Same target, six weeks later, with an upgraded payload built specifically to destroy AI training data and model files.

• “Months, not years.” Five national intelligence agencies just told security leaders that's the timeline for automated, agentic attacks. That's not hedged language, and it's not how these agencies usually talk.

• Gartner didn't call agentic AI a productivity win this year. They named it the top driver of a new, ungoverned attack surface.

The Same Door, Twice

The attack itself happened in late June 2026. Sysdig's Threat Research Team, led by senior director Michael Clark, published its findings on July 1, naming the operator JADEPUFFER, the first documented case of agentic ransomware.

A large language model, not a person, ran the entire kill chain. It exploited an old, already-known missing-authentication flaw in Langflow (an open source framework for building AI applications), harvested credentials, moved laterally to a separate production server, then encrypted and deleted its configuration database.

When one login failed, the agent diagnosed the problem and rebuilt admin access in 31 seconds. No one was watching in real time. No one needed to be.

Sysdig didn't get a tip-off. What gave JADEPUFFER away was the payloads: self-narrating code, dense with natural-language comments explaining each step's objective, the kind of thing an LLM writes and a human attacker skips.

It ran more than 600 distinct payloads in rapid succession, adjusting on the fly when something didn't go as expected. Sysdig says the operator is financially motivated, its origins unknown, with no overlap to any previously tracked group.

Key Takeaway: The vulnerability sat on CISA's must-patch list for fourteen months before the agent used it. The risk wasn't the AI's cleverness, it was an unpatched door nobody rechecked.

Weeks later, the same operator returned to the same compromised Langflow server with a new payload, EncForge, built to encrypt AI infrastructure rather than generic files.

It targeted roughly 180 file types tied to trained models and vector databases, including .gguf, .safetensors, and .pt formats, escaping through a mounted Docker socket and self-deleting once done.

Sysdig estimates recovering a single encrypted model can cost $75,000 to $500,000, since rebuilding means repeating months of training.

Key Takeaway: The entry point hadn't changed between attacks. A second incident on the same door means the first incident was never actually closed out.

Not everyone agrees how much credit the "no human involved" framing deserves. TechCrunch reported that Michael Clark clarified a person still set up the infrastructure, including the command-and-control server, staging server, and target selection, before the agent took over technical execution.

CSO Online quoted red teamer Vibhum Dubey calling the campaign an evolution in execution rather than a fundamentally new technique.

Fair debate. The same neglected server got hit twice either way.

The Math That Should Worry You

• CVE-2025-3248, the flaw JADEPUFFER used to get in, carries a CVSS (Common Vulnerability Scoring System) score of 9.8 and had been public for over a year. Translation: a critical, well-known hole, not a zero-day.

• Sysdig's own telemetry puts average time from initial access to full cloud compromise at 10 minutes. An analyst reading an alert over coffee is already too slow.

• Average time from public advisory to active weaponization: 10 hours, sometimes less. Sysdig cites a separate Langflow vulnerability actively exploited within 20 hours of its advisory.

• On June 22, the Five Eyes intelligence alliance issued a joint advisory stating frontier AI could reshape offensive cyber capability in "months, not years," an unusually direct timeline for that group to put in writing.

• Langflow is not an unlucky one-off. On July 7, CISA added CVE-2026-55255 to the same catalogue and gave federal agencies three days to patch. It is the seventh distinct Langflow flaw to enter active exploitation in a year, and it made Langflow the first AI agent platform ever to reach that list.
  
  

• The kicker: JADEPUFFER hit the exact same Langflow instance twice, weeks apart. Nobody rescanned it after the first attack. The vulnerability was still open when it came back with a worse payload.

An annual scan cycle isn't slow against this math. It's irrelevant.

If your last full asset scan was more than a quarter ago, you are, on average, already behind the exploitation window for whatever got disclosed since.

Your AI Governance Problem Is an Inventory Problem

Every headline this month is about how "autonomous" this attack was, and that's the wrong argument.

The real failure isn't artificial intelligence. It's an internet-facing AI tool nobody inventoried, a year-old critical remote code execution (RCE) flaw nobody patched, and no check on whether the door was still open after the first knock.

The reason Langflow keeps drawing this attention is architectural. Visual AI pipeline builders sit at the centre of model workflows and hold cloud credentials, third-party API keys and broad system permissions by design.

Gartner's framing backs this up. Agentic AI spreads through no-code platforms faster than security teams can register what exists, an inventory problem wearing an AI costume. Sysdig's own researchers called JADEPUFFER "a warning sign rather than a crisis," not because the technique was sophisticated, but because none of the individual steps were. Old vulnerability, default credentials, an exposed admin port.

The AI just chained them without a human between steps. This is exactly the kind of story that lights up r/cybersecurity, where practitioners have been largely unimpressed by the "autonomous" framing and more focused on the same unpatched Langflow instance getting hit twice.

A security lead at a Series B startup asked us: "If my AppSec team can't name every AI tool running in our environment today, what's actually different about our risk from JADEPUFFER's target?" Nothing. That's the point. Your AI governance conversation and your attack surface conversation are the same conversation now.

Every AI tool your developers spin up needs to show up in a scan, get patched on schedule, and get retested after any incident touches it nearby.

Three Fixes for This Quarter

A working checklist, not a wish list. Pull this into your next team meeting as is.

1. Inventory every AI tool reachable from the internet, not just your flagship applications.
   
   Langflow instances, vector databases, and model-serving endpoints get stood up fast by individual developers and rarely go through the same asset-registration process as a customer-facing product.
   
   If you can't list every internet-facing AI tool right now, you have the exact gap JADEPUFFER exploited. When you find Langflow, don't just check for the JADEPUFFER fix. Langflow has had seven distinct flaws exploited in the wild in the past year, so the only safe answer is the latest release, not a specific version number.
   
   
2. Rescan and retest after every incident, not just before one.
   
   The most damning detail this month is that the second attack hit the same unpatched door as the first.
   
   A fixed annual cycle can't catch that. Continuous testing triggered by an incident, not by the calendar, would have.
   
   
3. Treat default credentials and exposed admin interfaces as a first-class finding, not a footnote.
   
   JADEPUFFER didn't need a zero-day. It needed a database with root access reachable from the internet and a signing key nobody had rotated. Scanners flag these constantly.
   
   The fix is operational discipline, not more tooling.

We tested this exact problem for a Fortune 500 enterprise before their internal AI platform went live, closing prompt injection, session leakage and vendor isolation gaps while there was still time to close them: How Siemba secured a Fortune 500 internal AI platform.

Siemba combines continuous attack surface discovery with expert-led penetration testing, so the AI tools your teams spin up this quarter get found, tested, and retested, not left running until someone with an agent finds them first.

See how it works | Book a demo