First AI-Driven Ransomware Attack Still Required Human Involvement

Researchers at Sysdig have uncovered the first ransomware attack where artificial intelligence autonomously managed all technical stages of the operation. The malware, dubbed JadePuffer, infiltrated a vulnerable server through a flaw in Langflow—a popular platform for developing large language model (LLM) applications. The AI agent then moved to a MySQL production server, exploiting another known vulnerability to gain administrative privileges.

During the attack, over 1,300 configuration records were encrypted, and an AI-generated ransom note with a Bitcoin wallet for payment was left behind. A notable feature of the attack was its speed: the agent corrected a failed login attempt in just 31 seconds, even annotating its actions with natural language comments in the code. However, as Sysdig Senior Director Michael Clark emphasized, human involvement remained critical—attackers configured the infrastructure, selected the target, and provided stolen credentials for initial access.

Experts noted that the attack did not use multiple AI models simultaneously, contrary to initial assumptions. API keys for OpenAI, Anthropic, DeepSeek, and Gemini found on the compromised server were part of the stolen data, not tools used in the attack. The specific model driving the agent remains unknown, as Sysdig could not determine its configuration or system prompts.

Microsoft researcher Jeff McDonald suggested that the attack may have been orchestrated using an open-source model with removed safeguards rather than an advanced commercial LLM. This confirms that even relatively simple AI models can pose a threat when properly configured. Meanwhile, experts warn that the cost of launching such attacks is decreasing, which could lead to a rise in concurrent campaigns—though human oversight still remains a bottleneck.