# An AI Agent Ran a Ransomware Attack on Its Own

_JadePuffer is what the security firm Sysdig calls the first ransomware attack run start to finish by an AI agent, with no human directing it. The agent broke into a server, stole credentials, spread through the network and locked a company's database on its own._

By Johannes Keienburg, CEO & Founder  
Published: 2026-07-08  
Source: https://www.cakewalk.security/blog/jadepuffer-agentic-ransomware

---

For the first time, researchers have documented an AI agent running a full ransomware attack by itself. In July 2026, the security firm Sysdig published the case and named it JadePuffer. The agent got in through Langflow, an open-source framework for building AI agents. It exploited a flaw (CVE-2025-3248) that let it run code without logging in.

## One Agent Did the Whole Attack

A ransomware attack normally takes a team of people. This time one AI agent did all of it.

> An autonomous agent reasoned about its targets, harvested and reused credentials, moved laterally, established persistence, and destroyed a database, narrating its own intent the entire way.

_Sysdig Threat Research Team_

It even fixed its own mistakes. When a login failed, the agent found the problem and had a working fix in 31 seconds. It locked 1,342 records in the company's database. The agent made the key that could unlock them and threw it away. Now the data is gone for good, even if the ransom is paid.

## Now It Costs Almost Nothing to Run

What should worry defenders most is the cost.

> The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero.

_Sysdig Threat Research Team_

The agent used stolen credentials to move from one system to the next. Nothing checked whether it was allowed to. That is how one exposed server turned into a full breach.

> JadePuffer worked because the agent held real credentials and nothing stood between it and the systems it accessed. That is the exact pattern we build against. An agent should never hold a real password or key. It should start each task with no access and take on only what the person behind it may use. Every step it takes is checked as it happens and recorded once. Then even an agent gone rogue can only use the access it was given for that one task.

_Comment from Gil Röder, CPO & Co-Founder_

Source: Sysdig Threat Research Team, "[JADEPUFFER: Agentic ransomware for automated database extortion](https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion)", July 2026.