Agentic AI in Ransomware Attacks

Last Updated on September 9, 2026 by Arnav Sharma

Ransomware has always had a human somewhere in the loop, at the keyboard or writing the script. That assumption no longer holds. In July 2026, the Sysdig Threat Research Team documented what it assesses to be the first ransomware operation driven end to end by a large language model, an operator it named JADEPUFFER. The arrival of agentic AI in ransomware attacks marks a genuine shift in the threat landscape, and it is worth understanding what changed, what did not, and what security teams should do about it.

This is a close read of a real intrusion, the evidence that an autonomous agent ran it, and a defensive playbook mapped to the exact surfaces the agent touched. The novelty is not a new exploit. It is that an AI agent strung together ordinary techniques into a complete extortion operation with almost no human involvement.

What agentic AI in ransomware attacks actually means

Agentic AI describes systems that reason, plan, act, and adapt across long running, multi step tasks. Where traditional AI answers a single prompt and stops, an agentic AI system maintains state, calls tools, executes code, observes the result, and revises its plan. Understanding AI at this level matters, because that control loop is what separates agentic systems from the reactive AI models that came before them. It also reframes the wider conversation about agentic AI in cybersecurity, since the same AI capabilities that make these systems useful defensively make them potent offensively.

From AI-assisted to agent-operated

For the last two years, “AI in ransomware” mostly meant an attacker using a model as a helper. This was artificial intelligence as a productivity tool for crime, not as an operator. In August 2025, Anthropic reported disrupting a cybercriminal who used its Claude Code tool inside a large data extortion operation that affected at least 17 organizations, with the human operator still steering high level objectives. Academic analysis of ransomware misuse describes a similar pattern, where language models interpret stolen data, assist with victim profiling, and draft extortion messages while a person retains control. In those AI applications, the model reasons but the human still runs the operation.

JADEPUFFER is different in kind. The attack capability was delivered by an agent rather than a human driven toolkit. According to cloud security firm Sysdig, the agent handled reconnaissance, credential theft, persistence, privilege escalation, encryption, and the ransom note itself, adapting to failures on the fly without human intervention. The result was a data breach and destructive extortion event run almost entirely by a machine.

The autonomy spectrum

It helps to think in terms of autonomy levels. At the low end sits static inference, a single request and response with no self direction. In the middle sits tool assisted automation, where an AI agent follows preset logic to complete multi step workflows. At the high end, a fully agentic AI system plans, acts, and reflects with little oversight, pursuing a goal and choosing its own next step as conditions change.

Higher autonomy buys capability, but it also makes behaviour harder to predict and audit. That trade off is the core security challenge agentic AI introduces, and it is why autonomous security controls need to bound what an agent can do. JADEPUFFER is what the high end of that spectrum looks like when it is pointed at a victim, and it foreshadows a wave of security incidents where the operator is code, not a person.

Inside the first documented agentic ransomware attack

The operation unfolded across two targets: an internet facing Langflow instance that provided the way in, and a separate production database server that was the real objective. Langflow is an open source framework for building LLM driven applications and agent workflows, which makes it an ironic entry point for an AI powered attack.

Initial access and credential harvesting

The agent gained initial access by exploiting CVE-2025-3248, a critical missing authentication vulnerability in Langflow that lets an unauthenticated attacker run arbitrary Python on the host. Langflow servers are an attractive target because they sit close to AI workloads and frequently hold provider API keys and cloud credentials in their environment.

Once it had execution, the agent enumerated the host and swept for secrets in parallel: LLM provider API keys, cloud credentials, cryptocurrency wallets, and database configuration files. It then dumped Langflow’s own backing database and probed internal services with default credentials, harvesting more keys from a MinIO object store using the well known minioadmin:minioadmin pair. This is textbook opportunism, made dangerous by the speed and scale at which an agent runs it.

Lateral movement to the real target

Using what it had gathered, the agent pivoted to a production server running a MySQL database and an Alibaba Nacos configuration service. This lateral movement leaned entirely on old, well documented attack vectors: a 2021 Nacos authentication bypass, a default JWT signing key that has been public since 2020, and root level database access. None of this required novel tradecraft. It simply showed what happens when AI systems operate autonomously against neglected infrastructure.

The most telling moment came during a backdoor admin insertion. The first attempt failed a login check. Thirty one seconds later, without any human involved, the agent issued a corrected multi step payload that diagnosed the root cause, deleted the broken account, and rebuilt it properly. That correction was specific to the failure mode, not a blind retry.

Encryption, extortion, and destruction

For the ransomware stage, the agent encrypted 1,342 Nacos configuration items, dropped the original tables, and created an extortion table holding the demand, a Bitcoin address, and a contact email. It then escalated to dropping entire database schemas, narrating its own targeting rationale as it went, flagging the “largest” database as a high value target.

There is a cruel twist. The encryption key was generated randomly, printed once to standard output, and never saved or transmitted. The victim cannot recover the encrypted configurations even if they pay, turning a ransomware attack into pure destruction dressed up as extortion.

The evidence that a machine, not a human, was at the keyboard

Claims of a first are cheap. The reason Sysdig’s assessment holds up is that four independent lines of evidence point the same way.

• Self-narrating code. The decoded payloads are full of natural language commentary explaining why each action was taken, including prioritisation of which database to destroy. Human operators do not annotate disposable one line scripts this way. LLM code generation does so by default.
• Failure diagnosis at machine speed. The 31 second failed-login-to-fix window is the strongest tell. That corrective payload was 15 lines of coordinated code that deleted, diagnosed, rebuilt, and reinserted an account. A human doing the same takes far longer.
• Comprehension of planted context. The agent parsed free text from the environment and acted in a way that only makes sense if the text was read and understood, not pattern matched.
• Scale and coherence. More than 600 distinct, purposeful payloads ran in a compressed window, each building on the last.

For threat intelligence teams reconstructing the incident from security events and logs, this coherence across hundreds of steps is itself the fingerprint of an agent. The one honest ambiguity Sysdig flags is the Bitcoin address, which is the canonical example address embedded across Bitcoin developer documentation. Either the agent hallucinated it from training data, or the operator deliberately used a real wallet that happens to match the documentation example. Without visibility into the agent’s configuration, that question stays open, and the researchers say so rather than overclaiming.

Why old vulnerabilities suddenly matter more

Here is the uncomfortable lesson for anyone maintaining internet facing infrastructure. Every technique JADEPUFFER used was known and, in most cases, years old. What agentic AI changes is the economics.

Traditional security tools were tuned for human tempo and for a manageable set of prioritised risks. Agentic cybersecurity threats break that assumption. When an autonomous agent can spray the entire historical catalogue of known vulnerabilities across exposed systems, the marginal cost of trying each one drops toward zero, and previously complex security operations collapse into a single automated run. The long tail of unpatched, neglected, internet facing systems becomes more exposed, not less. As Sysdig puts it, the skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent runs on stolen compute through credential abuse, the cost to an attacker is close to zero.

This reframes the emerging threat. The danger is not a smarter adversary crafting novel attack patterns. It is a tireless one executing the boring, effective, well understood attacks against known threats at a speed and scale that no human team could match, widening the attack surface of every exposed system at once. This is an evolving threat landscape in which volume, not sophistication, is the multiplier. The academic literature agrees on the direction. One survey notes that agentic ransomware compresses a chain of compromise that once took days or weeks into minutes or hours. Palo Alto Networks’ Unit 42 built an agentic AI attack framework that completed a full ransomware lifecycle in roughly 25 minutes, and observed mean time to exfiltrate fall from around nine days in 2021 to about two days in 2024, with many incidents finishing exfiltration in under an hour.

The table below contrasts the two models.

Dimension	Traditional ransomware	Agentic ransomware
Operator	Human at the keyboard	Autonomous AI agent
Timeline	Days to weeks	Minutes to hours
Skill required	Significant expertise per stage	Cost of running an agent
Adaptation	Human reads errors, rewrites	Agent diagnoses and fixes in seconds
Tradecraft	Often novel or bespoke	Ordinary techniques, chained autonomously
Detection surface	Tooling and human patterns	Self-narrated intent in payloads

Turning agentic behaviour into a defensive advantage

The instinct after reading about an autonomous attacker is despair. That is the wrong response. The same properties that make agentic AI dangerous on offense create openings for defenders, one of them genuinely new.

Self-narration as a detection signal

Because an LLM narrates its own objectives inside its payloads, the attacker’s intent is now legible in a way it never was before. A human operator’s python3 -c one liner tells you what it does. An agent’s payload tends to tell you why, in plain language, complete with target prioritisation. That self narration is a detection and triage opportunity that did not exist against human run intrusions.

Threat detection and response pipelines can lean into this. Runtime behavioural monitoring that inspects the content of executed payloads across multiple data sources, not just their outcomes, can flag the natural language reasoning, the return-on-investment commentary, and the completion markers that agents write reflexively. This is a case where agentic AI and cybersecurity defence align: the machine’s chattiness is a gift to threat hunting. Human analysts still matter here. Rather than replacing them, this signal lets security analysts triage faster, focusing scarce attention on the intent an agent conveniently spells out. Effective detection and response now depends on reading that self narration before the destruction phase completes.

A controls map tied to the attack chain

Generic advice is easy to ignore. The controls below map directly to the surfaces JADEPUFFER actually attacked, which is what makes them worth prioritising.

Attack stage observed	Defensive control
Langflow RCE via CVE-2025-3248	Patch AI orchestration servers, never expose code execution endpoints to the internet
Secrets harvested from web-reachable host	Scope secrets to a manager, keep provider keys and cloud credentials away from web-facing processes
MinIO default credentials	Remove default credentials on config and object stores, enforce authentication
Nacos auth bypass and default signing key	Change default signing keys, upgrade to releases that force custom keys, never expose config services
Root database access over the internet	Restrict administrative accounts, enforce source-IP restrictions on management ports
Cron beacon to attacker infrastructure	Apply egress controls so a compromised host cannot beacon to arbitrary destinations

Notice a pattern. None of these are exotic AI-specific defences. They are disciplined fundamentals: least privilege, secrets hygiene, patch management, network segmentation, and egress control. Agentic attackers punish neglect efficiently, so closing basic gaps delivers outsized protection.

Building an agentic-ready security posture

A few principles help organisations prepare for a cybersecurity landscape where autonomous AI runs both offense and, increasingly, defence. The rise of agentic AI cuts both ways: the same frontier AI models that power these attacks also power new security tooling, and agentic AI offers defenders real leverage when deployed with care. Understanding these agentic AI security threats is the first step toward a resilient security posture, and organizations must weigh where autonomy helps and where it introduces AI risk. What follows is a set of security measures and security policies to guide any agentic AI deployment.

• Treat internet-facing application servers as first-strike targets. Exposed app servers, unhardened configuration stores, and internet-facing database admin accounts are the surfaces agents hit first. Inventory and harden them before anything else.
• Assume the historical vulnerability catalogue is in play. Continuous vulnerability management and regular vulnerability assessment can no longer deprioritise old, well documented issues on exposed systems simply because they are old. Automated agents make them cheap to exploit, so your security infrastructure should assume every known flaw will be tried.
• Invest in behavioural detection over signature matching. Agents recombine known techniques into new attack vectors and unpredictable attack scenarios. Detection tuned to these adaptive threats and to intent holds up better than detection tied to fixed signatures, which matters as security operations centers face agent driven tempo.
• Keep humans on the loop for irreversible actions. As defensive AI takes on more of security operations, the consistent lesson from both research and deployment is that critical security decisions with irreversible impact need human oversight and clear escalation boundaries. Human security judgement should never run without constant human oversight on the highest impact calls.
• Secure your own agents. When deploying agentic AI, remember that the same autonomy is a liability if the agent is compromised. Scoped credentials, sandboxing, and intent-bound delegation limit the blast radius when an agent is turned against you, which is central to how agentic AI systems operate safely in production.

Securing agentic AI is now part of the same conversation as defending against it, and the line between AI and agentic AI blurs further with every release. Defensive AI can analyze payload behaviour, telemetry, and intent at the same speed an attacker generates it, and thoughtful AI implementation addresses many of these security challenges before they reach production. For security professionals weighing the future of agentic AI, the takeaway is steady rather than alarming: the way agentic AI addresses attacker tempo is by pairing disciplined fundamentals with detection that reads intent. Treat AI security and traditional security as one discipline, not two.