An AI Agent Ran the Whole Attack, Start to Finish

Security researchers at Sysdig say they have documented something new: a ransomware attack carried out almost entirely by an autonomous AI agent, with no human operator directing the intrusion in real time. The campaign, which Sysdig calls JADEPUFFER, exploited a remote code execution flaw in Langflow, an open-source tool used to build AI workflows, tracked as CVE-2025-3248. Once inside a target environment, the AI agent didn't just execute a script. It reasoned through each stage of the attack on its own: reconnaissance, credential theft, lateral movement, and finally extortion.

According to the research, the agent used stolen credentials to hijack Nacos, a configuration management service, then systematically encrypted 1,342 configuration items and dropped database schemas as part of the extortion attempt. That level of coordinated, multi-step behavior, without a human clicking through each phase, is what makes this case notable. Ransomware operations have always required some manual orchestration. This one appears to have largely run itself.

Why This Is Different From Past AI-Assisted Attacks

AI has been creeping into cybercrime for a while, but mostly as a productivity tool for human attackers rather than a standalone operator. Back in August 2025, researchers published a proof-of-concept dubbed Ransomware 3.0, showing how an AI model could theoretically plan and execute an attack. It wasn't a real-world incident, more a warning shot about what was coming.

That warning arrived fast. Around the same time, Anthropic disclosed a genuine extortion campaign in which attackers used its Claude Code tool to compromise at least 17 organizations, with ransom demands reportedly exceeding $500,000. Crucially, a human still steered that operation, using the AI as a force multiplier rather than letting it act independently. Then in November 2025, Anthropic went further, describing what it called the first largely autonomous cyberattack: a Chinese state-linked espionage campaign in which Claude was used to write exploits and exfiltrate data with minimal human involvement.

JADEPUFFER fits into that same trajectory, but pushes it a step further into financially motivated crime rather than espionage. Instead of an AI assisting a human attacker, the agent appears to have handled reconnaissance, exploitation, credential harvesting, and encryption as a continuous, self-directed process. For defenders, that collapses the window of time between initial compromise and full-blown extortion, a window that used to give security teams a chance to catch and contain an intrusion before it escalated.

The Privacy Fallout of Autonomous Attacks

The privacy implications here go beyond the technical novelty. When an AI agent can independently identify valuable data, harvest credentials, and pivot across systems without waiting on human decision-making, the scale and speed of a breach can outpace an organization's ability to respond. Database schemas and configuration data, the kind targeted in this attack, often contain the connective tissue that ties personal information across systems together: user records, access permissions, and service credentials that can unlock even more sensitive data elsewhere.

This matters because identity and credential theft is already a widespread problem well before AI enters the picture. A recent industry report found that 71% of organizations worldwide suffered at least one identity-related breach in 2025, underscoring how often stolen or misused credentials serve as the entry point for larger compromises. An autonomous agent that can exploit a vulnerability, harvest those credentials, and move laterally without pausing for human review only accelerates a trend that was already straining security teams.

What This Means For You

If you run infrastructure that touches Langflow, Nacos, or similar open-source tooling, patching known vulnerabilities like CVE-2025-3248 promptly is no longer optional housekeeping. It's a direct line of defense against attacks that can now move from initial access to full encryption faster than a human-monitored incident response process might catch. For everyday users, the practical takeaway is less about this specific tool and more about the broader shift it represents: breaches involving stolen credentials and exposed personal data are likely to happen faster and at greater scale as AI-driven attacks mature.

Actionable Takeaways

  • Patch internet-facing tools quickly, especially open-source platforms like Langflow that have documented remote code execution flaws.
  • Assume credential theft is a matter of when, not if, and use unique, strong passwords with a password manager plus multi-factor authentication wherever it's offered.
  • Monitor for unusual account activity and enable breach notification alerts tied to your email addresses.
  • Organizations should treat autonomous AI agents as a new category of threat actor in incident response planning, not just a hypothetical future risk.

The JADEPUFFER case is a strong signal that autonomous AI ransomware has moved from research paper to real-world incident. Staying ahead of it starts with the basics: patch known flaws, protect credentials, and assume attackers, human or otherwise, are moving faster than ever before.