Researchers have documented the first instance of ransomware operations being managed by an artificial intelligence agent, according to a report by Sysdig. While the AI did not complete every phase of the attack, it significantly streamlined the process for the threat actor, accelerating the operation and providing distinct advantages.
The attack, which occurred in late June 2026, saw an AI agent orchestrate multiple stages of a ransomware campaign. This included reconnaissance, credential theft, lateral movement within the network, establishing persistence, encrypting data, destroying information, and delivering the ransom note. Sysdig researchers are tracking the group responsible as JadePuffer.
Michael Clark, senior director of threat research at Sysdig, noted that while attackers have long used scripting to automate attacks and AI has been employed to speed up individual steps, this incident represents a shift. In this case, the AI agent's decision-making drove the attack from beginning to end, rather than relying on a human operator at a keyboard.
The initial access point for the attack was an exploit of a Langflow vulnerability, identified as CVE-2025-3248. From there, the AI agent targeted a production server running MySQL and Alibaba Nacos. Sysdig identified several factors contributing to what they describe as the first documented use of agentic ransomware.
The payloads used in the attack contained plain-language descriptions of their objectives and identified high-value databases. Researchers believe this was a default annotation feature of large language models. The AI agent also demonstrated a rapid ability to diagnose and overcome obstacles, as evidenced by its redeployment of a corrected payload within 31 seconds of encountering an error.
In total, the AI agent executed over 600 distinct payloads in quick succession. Clark highlighted the agent's ability to autonomously resolve issues, such as a failure with a Nacos backdoor. The agent reportedly analyzed the error, switched its approach from subprocess calls to direct library imports, and redeployed the payload at a speed unattainable by human operators.
Evidence suggests that multiple AI models were utilized during the attack. The agent accessed keys for OpenAI, Anthropic, DeepSeek, and Gemini as it gathered intelligence on the victim's systems. Sysdig did not disclose the identity of the victim.
Despite the AI's central role, human involvement remained significant. Clark stated that a person was responsible for initiating and directing the operation, provisioning the necessary infrastructure including command-and-control and staging servers, and selecting the target. The AI agent also connected to the victim's MySQL server using root credentials that were not obtained from the victim's environment, indicating a prior compromise by a human.
The origins of JadePuffer, described as a financially motivated threat actor, are unknown, and they do not appear to be linked to any established ransomware groups or nation-state actors. Clark expressed concern that the skill barrier for conducting a full ransomware operation has been significantly lowered, now potentially limited by the cost of running such an AI agent. Sysdig has not yet observed similar attacks against other victims and anticipates that this type of agentic ransomware operation will become more prevalent due to its low operational cost.
