Ransomware just ran itself with no human at the keyboard.
Not a theory, and not a trailer for a conference keynote. Sysdig's threat research team captured what it assesses to be the first ransomware operation driven from start to finish by a large language model, one that kept adapting on its own every time a step failed.
The agent, nicknamed JadePuffer, entered through an unlocked door in Langflow, an open source toolkit that teams use to build AI workflows. The flaw is missing authentication, which is a polite way of saying anyone could reach the code execution panel.
From there it harvested credentials, mapped the network, and pivoted to a production database. It encrypted 1,342 configuration records, deleted the originals, and left a Bitcoin ransom note behind.
Researchers tallied more than 600 payloads, and the payloads read like diary entries with target priorities written into the code. When one attempt to create an admin account failed, the agent diagnosed and fixed it in 31 seconds, with no phone call to a human anywhere.
For years the one thing that kept ransomware human was the operator pool, a scarce group that behaves, as we covered before, like one shared economy. That bottleneck just evaporated.
The new reality is simple: an extortion campaign no longer needs a human planner, so your defense must stop assuming one will always be in the loop.
The discipline that answers this is older than the trend. Zero trust architecture in practice means no device, tool, or agent acts on trust alone, which is exactly the posture an autonomous attacker struggles to exploit.
Three habits matter more than any new tool.
- Patch the AI tools you forgot you exposed. JadePuffer did not break through your firewall, it walked through an internet facing Langflow server, the same class of tool your team may have spun up last quarter. Inventory every public AI surface, from workflow builders to notebook servers to vector stores, close the ones you do not need, and patch the rest within hours of a release.
- Protect your models like they are customer data. Researchers have already documented a ransomware strain built to encrypt AI model weights, vector indexes, and training data, because a fine tuned model is brutally expensive to rebuild. Encrypt those assets at rest, keep immutable backups offline, and treat a sudden bulk read of embeddings as an alert, not a background job.
- Drill for machine speed, not human speed. One ransomware group has already handed hands on exploitation to an AI coding agent across ten targets, which collapses the time between first access and full damage. Run drills that assume an agent is already inside, automate containment, and rehearse restore until it is boring, using the 60 minute containment emergency guide as your starting point.
The old game belonged to whoever was most patient, because an attack took days and defenders had hours to notice. The new game belongs to whichever team contains the breach fastest, because the attacker side does not sleep, blink, or negotiate.
You do not need to be the person who stops the descendants of JadePuffer. You need to know your own gaps first, so take the free five minute cybersecurity fundamentals check and let the results surprise you before an attacker does.
Question for you: which part of your security stack still assumes a human attacker will get tired, blink, or make a mistake first?
Sources: Sysdig research on JADEPUFFER, The Hacker News on the Langflow campaign, The Hacker News on model targeting ransomware, and The Hacker News on AI agents in live attacks.