A cloud security firm called Sysdig documented what it describes as the first known ransomware attack run entirely by an AI agent. Researchers named the attacker JADEPUFFER and said it operated without any human typing commands or making decisions. The AI handled everything: finding a way in, collecting passwords and access keys, moving to a second server, and destroying a database while leaving a ransom note.
The door in was a security flaw in a tool called Langflow. Langflow is software that companies use to build AI-powered applications, and it had a critical weakness: anyone who could reach the server over the internet could run their own code on it without a password. The flaw was fixed in early 2025 and added to the US government's official list of actively exploited vulnerabilities in May 2025. The victim's server was never updated.
Once inside, the agent swept through the Langflow server collecting everything useful: API keys for AI services like OpenAI and Anthropic, cloud credentials for providers across the US, Europe, and China, and database passwords. It then set up a way to phone home every 30 minutes to keep access alive. The real target was a separate production database on a different server.
To reach that second server, the agent used a combination of a 2021 authentication bypass flaw and a default signing key that the database software had shipped with since 2020 and which the operator had never changed. The agent planted its own admin account, encrypted all 1,342 configuration records in the database, deleted the originals, and left a ransom demand with a Bitcoin address and a Proton Mail contact.
The ransom was broken from the start. The encryption key was generated once, displayed on screen for a moment, and never stored or transmitted anywhere. Paying would have recovered nothing. The Bitcoin address in the note turned out to be a well-known example address from developer documentation, likely pulled from the AI model's training data rather than a real wallet.
The clearest sign that no human was operating the attack came from a 31-second window. The agent tried to create an admin account, saw the attempt fail, diagnosed the error, and issued a corrected command that worked, all within half a minute. Human attackers reading error messages and rewriting scripts take considerably longer. The AI-generated code also left detailed comments inside its own attack payloads explaining its reasoning, something human attackers almost never do but that AI models produce automatically.
Sysdig noted that none of the individual techniques were new or especially sophisticated. What changed is that an AI agent connected all of them into a complete attack without the operator needing expertise in any single step. The cost of running such an attack now drops to roughly the cost of running an AI agent, and if that agent is operating on stolen API keys, the cost to an attacker approaches zero.
The numbers sitting behind this story are worth pausing on. Stolen credentials were the starting point in 22 percent of all data breaches in 2025, according to Verizon's breach report. IBM puts the average cost of a credential-based breach at around 4.4 million dollars. And nearly three quarters of security teams, according to survey data, say they cannot stop a credential-based attack in real time.
That last point is where JADEPUFFER changes the calculation. When a human attacker spends hours moving through a network, there is at least a window to catch the intrusion. When the gap between a failed login and a working admin account is 31 seconds, that window closes before most monitoring systems have sent an alert.
The practical answer here is not especially technical. Patches need to be applied promptly, default passwords need to be changed before a system goes anywhere near the internet, and administrative access should be time-limited and tied to specific tasks rather than left permanently open. Passwords, API keys, and cloud credentials stored in application environments need to move into dedicated secure storage. And access sessions need to be watched while they are running, not reviewed in logs after damage is done.
One caveat worth noting: Sysdig sells products designed to detect exactly these kinds of automated attacks. That does not make their findings wrong, but independent confirmation from the victim, law enforcement, or other researchers has not yet appeared. The core finding, an AI agent running a complete attack chain autonomously, is consistent with the direction the threat has been heading, and the underlying security failures described are real and common regardless of who uncovered them.