Picture a break-in where the burglar isn’t a person at all — just a piece of software that let itself in, figured out what was valuable, grabbed it, and left a note demanding payment, all without anyone directing it step by step. That’s essentially what happened to a real company recently, and security researchers say it’s the first time they’ve seen it.
The attack is called JADEPUFFER, and it was flagged by researchers at Sysdig. It’s being called the first fully “agentic” ransomware operation — meaning an AI agent, not a human hacker, ran the entire thing from start to finish.
Here’s how it played out. The attackers got their initial foothold through a known security flaw in Langflow, a tool developers use to build AI-powered workflows. Normally, that’s where the human takes over — poking around the network, deciding what’s worth stealing, writing custom scripts to move deeper in. Not this time. An AI agent took the wheel from there: scanning the network, stealing login credentials, hopping between systems, quietly setting up backdoors, and climbing its way up to admin-level access. It eventually found its way to a production database, encrypted 1,342 records, deleted the originals, and left behind a ransom note demanding Bitcoin.
What tipped researchers off that a machine was driving, not a person? The code itself. It was littered with plain-English notes explaining the agent’s own reasoning — comments about which database looked most valuable, or why a particular target was worth prioritizing. That’s not something a human attacker typically bothers to write down in throwaway malware. It’s exactly the kind of running commentary a language model produces by default when it’s generating code. There was also a moment where a login attempt failed, and the agent diagnosed the problem and fixed it on its own in 31 seconds — no human troubleshooting, no delay.
The reason this matters goes beyond one attack on one company. Ransomware has always had a floor of required skill — you needed someone who actually understood networks, credentials, and lateral movement well enough to pull it off without tripping alarms. JADEPUFFER suggests that floor is disappearing. You no longer need that expertise yourself; you just need an agent capable enough to acquire it on the fly, and increasingly, those agents exist and are getting easier to point at a target.
It’s a genuinely awkward problem for cybersecurity as a field, because so much of threat detection is built around recognizing human patterns — the pace at which people move, the mistakes they tend to make, the hours they tend to work. An agent that adapts in seconds, doesn’t get tired, and doesn’t need sleep breaks those assumptions completely.
It’s also a strangely well-timed wake-up call. This same week, the UN opened a Global Dialogue on AI Governance in Geneva, with countries trying to hash out rules for AI before it outpaces their ability to regulate it. JADEPUFFER is about as concrete an example as you could ask for of what they’re racing against.
None of this means every AI agent is a ticking time bomb — the same underlying capability that ran this attack is also what’s helping researchers find bugs, write code, and automate legitimate work faster than ever. But it’s worth sitting with the asymmetry here: the skill required to launch a serious cyberattack just dropped sharply, while the skill required to defend against one hasn’t gotten any easier. If a lone AI agent can now do the work of an entire hacking crew, what happens to the small businesses and organizations that can’t afford an AI-powered defense of their own?
JOSIAH Miri 