Has ransomware become self-aware? Researchers at Sysdig's Threat Research Team (TRT) say they’ve documented what may be the first known case of agentic ransomware — an attack in which an AI agent autonomously executed the technical stages of a ransomware campaign after the target and infrastructure had been established.
The campaign, dubbed JADEPUFFER, exploited a vulnerable internet-facing Langflow instance, harvested credentials, moved through the environment and ultimately encrypted and destroyed data, according to a warning issued by the TRT.
For CIOs, CISOs and other tech leaders, the story is less about a single malware family than about a broader shift in the economics of cybercrime. According to reports from Cyberscoop, Sysdig and other sources, AI is beginning to replace the human operator who traditionally stitched together reconnaissance, credential theft, lateral movement and data destruction.
Among the many tactics of the documented attack case, one stands out as significant and frightening: The ransomware demand was made to the victim, but no backup was made, and no key or report was created. So, even if the ransom was paid, the data would remain unrecovered.
Why IT executives should pay attention
Several key factors make it important for IT leaders to care about this documented attack.
AI lowers the barrier to cybercrime. Complex ransomware operations no longer require the same level of specialized expertise. According to Sysdig's analysis, the AI agent handled reconnaissance, credential harvesting, lateral movement and destructive actions with limited human intervention.
Old weaknesses become bigger risks. JADEPUFFER relied primarily on known vulnerabilities, default credentials and misconfigurations — not exotic zero-day exploits. AI simply makes exploiting those weaknesses faster, cheaper and easier to scale across large numbers of exposed systems.
Attack speed now exceeds human review cycles. Security programs built around monthly vulnerability reviews or quarterly assessments are increasingly mismatched against attacks that can adapt to failures and continue operating in near real time.
AI infrastructure is now part of the attack surface. Both Sysdig and SecurityWeek report that enterprises rapidly deploying AI tools without applying the same governance used for traditional enterprise applications are creating new pathways into production environments. Internet-facing orchestration platforms, embedded API keys and weak credential management become attractive targets.
What made JADEPUFFER different?
Several characteristics distinguish this attack from traditional ransomware campaigns.
Autonomous execution. The AI agent progressed through multiple stages of the attack chain without continuous human guidance.
Self-correction. When login attempts or code execution failed, the agent modified its own code, adjusted its approach and retried, demonstrating operational adaptability that previously required a human operator.
Self-narrating code. Captured payloads included natural-language comments explaining the agent's objectives and priorities. That behavior could become a valuable detection signal because the malware effectively reveals its intent while operating.
Researchers also noted that the attack exploited CVE-2025-3248 in Langflow, reinforcing the point that timely patching of known vulnerabilities remains one of the most effective cybersecurity defenses.
You can read full technical details about how the attack was executed on the Sysdig warning blog.
The bigger business lesson
JADEPUFFER demonstrates that AI doesn't need to invent new attack techniques to change cybersecurity. It simply automates existing ones at machine speed.
The environments compromised in this campaign shared a familiar profile: internet-facing AI infrastructure, known vulnerabilities that had gone unpatched, default or unchanged credentials, and production systems that were too loosely connected to experimental AI tooling. That describes a much larger population of organizations than many executives would like to admit.
Quiz