JadePuffer Demonstrates How AI Agents Can Automate Ransomware Attack

Sysdig analyzed 'JadePuffer', a ransomware campaign that appears to have been executed autonomously by an AI agent: the attacker exploited an unauthenticated RCE in Langflow, extracted credentials and secrets, pivoted to a production MySQL server running Alibaba Nacos via an authentication bypass, established persistence (cron-based C2), escalated privileges, and encrypted 1,342 Nacos configuration records before leaving a ransom note; the encryption key was not retained or exfiltrated, rendering recovery impossible even if ransom were paid. Researchers cite adaptive behavior (automatic parsing changes, retrying authentication), extensive natural-language comments in payloads, and use of known vulnerabilities and misconfigured internet-facing services, highlighting that standard hardening and patching remain effective mitigations.