AI Agent Pulls Off a Ransomware Assault With out Human Assist

An autonomous synthetic intelligence agent has carried out what researchers describe as the primary agentic ransomware assault, exploiting vulnerabilities, stealing credentials and encrypting a manufacturing database with out human intervention.

See Additionally: Know Thy Enemy: Threats to Cyber Resilience

Cloud safety agency Sysdig attributed it to a menace actor it tracks as Jadepuffer. Researchers mentioned the incident reveals that enormous language fashions can autonomously execute a full ransomware life cycle, together with reconnaissance, credential theft, lateral motion, privilege escalation and knowledge encryption.

The findings come because the cybersecurity businesses of the 5 Eyes alliance warn that advances in AI are accelerating the pace, scale and class of cyberthreats. “The timeline is just not years; it’s months,” the businesses mentioned in a joint assertion in June (see: 5 Eyes Warn the Frontier AI Cyberthreat Is Months Away).

The intrusion started with the exploitation of CVE-2025-3248, a vital authentication bypass vulnerability in Langflow’s code validation endpoint. Langflow is an open-source framework used to construct AI functions and agent workflows. The flaw permits unauthenticated distant code execution on uncovered servers and was added to CISA’s Identified Exploited Vulnerabilities catalog in Could.

After gaining entry, Jadepuffer searched the compromised setting for cloud credentials, API keys, cryptocurrency wallets, configuration information and database secrets and techniques. It dumped Langflow’s PostgreSQL database to reap saved credentials, scanned inside networks and accessed an uncovered MinIO object storage service utilizing default credentials. Researchers mentioned the agent additionally established persistence by deploying a cron job that beaconed to attacker-controlled infrastructure each half-hour.

Utilizing the harvested credentials, the AI agent moved to a separate, internet-exposed manufacturing server working MySQL and Alibaba’s Nacos configuration platform. It exploited CVE-2021-29441, abused Nacos’ default JWT signing key and injected a backdoor administrator account into the platform’s database earlier than launching the extortion section.

The ransomware encrypted 1,342 Nacos configuration information utilizing MySQL’s built-in encryption capabilities, deleted the unique tables and changed them with a ransom word demanding cost in Bitcoin.

Sysdig mentioned the AI agent tailored when an try to create an administrator account failed, diagnosing the error and producing a working various inside 31 seconds. Researchers additionally recognized tons of of payloads containing natural-language reasoning and self-generated annotations explaining the agent’s choices.

The assault didn’t depend on zero-day vulnerabilities or novel strategies. As a substitute, it mixed recognized vulnerabilities, uncovered companies, default credentials and publicly documented weaknesses into an automatic intrusion chain.

Sysdig mentioned it discovered no proof that the attackers retained a decryption key or backup of the encrypted knowledge, suggesting victims can be unable to get well their info even when they paid the ransom.