The First Ransomware Attack Run by a Machine — and Why Your Board Should Care

In my experience, the questions that matter most in a boardroom are the ones nobody has had to ask before. Here is one that just arrived: what happens to your risk model when the attacker is no longer a person?

Last week, the Sysdig Threat Research Team published its findings on an intrusion it calls JADEPUFFER. Their assessment is that it is the first documented case of agentic ransomware — an extortion operation run end to end by an AI agent rather than a human at a keyboard. The model did the reconnaissance. It stole the credentials. It moved from one system to the next, planted persistence, encrypted the data, and wrote the ransom note itself.

None of the individual techniques were new. That is exactly what should get your attention.

What actually happened

The agent got in by exploiting a known flaw in Langflow, an open-source tool for building AI applications (the vulnerability is cataloged as CVE-2025-3248, a missing-authentication bug that lets an unauthenticated attacker run code on the host). From there it pivoted to its real target: a production server running a MySQL database and an Alibaba configuration service called Nacos.

Then it went to work. Sysdig counted more than 600 distinct, purposeful payloads executed in a compressed window. The agent's own code narrated its reasoning in plain language — which databases were "high-ROI," which one was "largest" and worth destroying. Human attackers don't annotate their throwaway scripts that way. AI-generated code does it by reflex, and that narration is how the researchers knew what they were looking at.

The most telling moment was a failure. The agent tried to plant a backdoor administrator account, and the login didn't work. Thirty-one seconds later — with no human involved — it had diagnosed the cause, rewritten the code, and succeeded. As Michael Clark, who leads threat research at Sysdig, put it: the agent "read the error, switched its approach ... and redeployed at a speed no human matches."

At the end, the agent encrypted 1,342 configuration items, dropped the original tables, and left a Bitcoin address and a contact email. There is a cruel footnote here: the encryption key was generated at random, printed once, and never saved. The victim cannot recover the data even if they pay. The machine didn't care whether the extortion worked. It just completed the task.

The part that should reframe the conversation

It would be easy to read this as another AI scare story. It isn't. Here is the line from Clark that belongs in your next risk discussion: "The skill floor for running a full ransomware operation just dropped to whatever it costs to run an agent."

For years, a sophisticated multi-stage intrusion implied a capable human on the other end — someone with real expertise, which meant there were only so many of them. That assumption is now wrong. The expertise has been packaged into a model that a far less skilled operator can point at a target and let run.

And notice what the agent chose to attack: a years-old vulnerability and an unchanged default password on neglected, internet-facing infrastructure. This was not a zero-day. It was the long tail of things nobody got around to patching. Agents make it effectively free to spray the entire back catalog of old vulnerabilities against every exposed system at once. The unpatched box you've been meaning to deal with just became more exposed, not less.

One more thing worth keeping honest: a person was still in this. Clark confirmed a human set up the infrastructure, chose the victim, and supplied database credentials stolen in an earlier breach. The agent isn't autonomous in the science-fiction sense. But it collapsed the skilled labor that used to be the bottleneck — and that is the change that matters to your business.

Reading this through the Three Questions

Regular readers know I keep coming back to three questions a board should be able to answer about any material risk: What are we most afraid of? How would we know if it happened? What have we already decided to do about it? Agentic attacks stress all three.

What are we most afraid of? For most organizations the honest answer is no longer a single brilliant adversary. It is volume — cheap, tireless automation testing every weakness you have at once. Your defensive posture was probably scoped for human attackers working at human speed. That scoping is now optimistic.

How would we know? Here is the rare piece of good news. Because the agent narrates its own intentions in its code, it hands defenders a detection signal they didn't have before. But that only helps if you have runtime monitoring that can see behavior inside your systems — not just a compliance checkbox saying a tool is installed. This is the compliance-versus-security gap I write about constantly. A passed audit would not have stopped JADEPUFFER. Watching what was actually happening on that database server might have.

What have we decided to do? This is where most boards go quiet, and it is the most important of the three. The basics that would have blocked this attack are unglamorous: patch known vulnerabilities, change default credentials, and keep database admin accounts off the public internet. The reason they don't get done is rarely technical. It's that no one owned the decision.

What to ask your CISO this week

You don't need to understand Langflow or Nacos to govern this risk. You need to ask three plain questions and listen for whether the answers are specific or vague:

First: If an automated attacker probed every internet-facing system we own tonight, what would it find? If the answer isn't a current, credible inventory, that's the first gap.

Second: Would we detect an intrusion by its behavior, or are we relying on knowing the attacker's tools in advance? Agentic attacks generate novel code every time. Signature-based defenses that wait to recognize known-bad tools will miss them.

Third: Which of our known, unpatched issues are exposed to the internet right now, and who owns closing them? Notice the word owns. The technology to fix this has existed for years. What's usually missing is a name next to the task and a date on the calendar.

The uncomfortable truth of JADEPUFFER is that it succeeded using mistakes we already knew how to prevent. The attacker just automated the patience. Your defense has to be the discipline to close those gaps before something cheaper and faster than any human finds them for you.