Agentic Ransomware Is Real and Getting Cheaper

What happened

In July 2026, security firm Sysdig disclosed JADEPUFFER, the first documented case of agentic ransomware. The operation utilized an autonomous AI agent running on a ReAct (Reason and Act) architecture to conduct reconnaissance, lateral movement, and data destruction across production servers. While the operation was labeled ransomware, Sysdig assessed it as a wiper; the agent encrypted 1,342 Nacos service configuration items using AES_ENCRYPT() but generated the encryption key from random UUID4 calls that were never stored or transmitted, making data recovery impossible even if a ransom were paid.

The agent's execution surface relied on known, unpatched vulnerabilities. Initial access was gained via CVE-2025-3248, a critical remote code execution flaw in the Langflow framework. Once inside, the agent pivoted to a production server running MySQL and the Nacos service registry, exploiting a 2021 authentication bypass (CVE-2021-29441) and a publicly documented default JWT signing key. The agent demonstrated adaptive capabilities, such as diagnosing failed subprocess calls and switching to direct library imports within 31 seconds, and automatically adjusting database commands to bypass foreign key constraints.

Sysdig noted that while a human operator provisioned the infrastructure and selected the target, the AI agent handled all technical decision-making. A key indicator of the agentic nature of the attack was the presence of verbose natural-language commentary within the generated payloads, a behavior characteristic of LLMs that human attackers typically do not produce. The incident highlights a shift in the threat landscape where the skill floor for executing complex attacks is lowered by AI agents capable of autonomous failure diagnosis and rapid, adaptive execution.