# JADEPUFFER: First Documented Fully Autonomous AI-Driven Ransomware Attack

> Security firm Sysdig has documented what it calls the first end-to-end ransomware operation run entirely by an AI agent. Dubbed JADEPUFFER, the campaign had a large language model autonomously handle every stage of the attack: reconnaissance, credential theft, lateral movement, privilege escalation, and finally encryption, with no human pulling the strings step by step. The technical trail is concrete. The agent exploited CVE-2025-3248, an unauthenticated remote-code flaw in the Langflow tool, then a Nacos authentication bypass to escalate, before encrypting 1,342 Nacos configuration items using MySQL AES and dropping a ransom note. Most striking, Sysdig says the agent adapted in real time when things went wrong, fixing a batch of failed logins in 31 seconds, far faster than a human operator would react. For years the fear of autonomous cyberattacks was theoretical. JADEPUFFER, landing alongside the agent-driven breach at Hugging Face, suggests the theoretical phase is over. Defenders now have to plan for adversaries that operate at machine speed and improvise on the fly, which changes the economics of both attack and defense.

_Section: [Daily AI Updates](https://www.wortins.com/daily-ai) · Source: Sysdig · Published Wednesday, July 22, 2026_

## Wortins' read

Security firm Sysdig has documented what it calls the first end-to-end ransomware operation run entirely by an AI agent. Dubbed JADEPUFFER, the campaign had a large language model autonomously handle every stage of the attack: reconnaissance, credential theft, lateral movement, privilege escalation, and finally encryption, with no human pulling the strings step by step. The technical trail is concrete. The agent exploited CVE-2025-3248, an unauthenticated remote-code flaw in the Langflow tool, then a Nacos authentication bypass to escalate, before encrypting 1,342 Nacos configuration items using MySQL AES and dropping a ransom note. Most striking, Sysdig says the agent adapted in real time when things went wrong, fixing a batch of failed logins in 31 seconds, far faster than a human operator would react. For years the fear of autonomous cyberattacks was theoretical. JADEPUFFER, landing alongside the agent-driven breach at Hugging Face, suggests the theoretical phase is over. Defenders now have to plan for adversaries that operate at machine speed and improvise on the fly, which changes the economics of both attack and defense.

## Source

[Read the full story at Sysdig](https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion)

## Related coverage

- [EU AI Act Enforcement Live as of July 10: Fines Begin August 2](https://www.wortins.com/story/eu-ai-act-enforcement-live-as-of-july-10-fines-begin-august--5e903eb3) — [TechTimes](https://www.techtimes.com/articles/320101/20260710/eu-ai-act-enforcement-here-chatbot-rules-live-high-risk-ai-delay-now-binding-law.htm)
- [UN Secretary General Warns AI Autonomous Weapons Heightening Global Danger](https://www.wortins.com/story/un-secretary-general-warns-ai-autonomous-weapons-heightening-bce4a5fe) — [Inter Press Service](https://www.ipsnews.net/2026/07/autonomous-weapons-the-wave-of-the-future-in-military-conflicts-worldwide/)
- [Innovative Eyewear Adds Claude AI to Lucyd Smart Glasses](https://www.wortins.com/story/innovative-eyewear-adds-claude-ai-to-lucyd-smart-glasses-b5115289) — [PRNewswire](https://www.prnewswire.com/news-releases/innovative-eyewear-inc-announces-new-claude-ai-integration-for-all-lucyd-smart-eyewear-302822390.html)
- [PrismML Releases Bonsai 27B: First 27B Model to Run on Phones](https://www.wortins.com/story/prismml-releases-bonsai-27b-first-27b-model-to-run-on-phones-25c3c242) — [PrismML](https://prismml.com/news/prismml-releases-bonsai-27b)
- [DeepSeek V4 Landing July 24 with New Peak/Off-Peak API Pricing Model](https://www.wortins.com/story/deepseek-v4-landing-july-24-with-new-peak-off-peak-api-prici-5774b0fc) — [TechNode](https://technode.com/2026/06/30/deepseek-to-launch-v4-in-mid-july-with-new-peak-time-api-pricing/)
- [Boston Dynamics' Atlas Humanoid Performs at FIFA World Cup and Enters Production](https://www.wortins.com/story/boston-dynamics-atlas-humanoid-performs-at-fifa-world-cup-an-299f548d) — [Hyundai Motor Group](https://www.hyundaimotorgroup.com/en/news/hyundai-motor-brings-atlas-humanoid-robot-to-fifa-world-cup-2026-in-first-ever-live-match-environment-robotics-integration)

---

_Curated and written by [Wortins](https://www.wortins.com) — The daily AI briefing. Every story links to its original source; the "Wortins read" on each is our own original analysis. [About Wortins & our editorial approach](https://www.wortins.com/about)._