AI Agents Are Now Running Entire Cyberattacks, Start to Finish
Two separate investigations show that criminals are handing whole attack campaigns to artificial intelligence, cutting the time it takes to ransack a company from weeks to hours.
Key points
- Security firm Sysdig documented a full criminal campaign, named JadePuffer, run end-to-end by an autonomous AI agent in 2025.
- JadePuffer exploited CVE-2025-3248, a vulnerability in Langflow (a tool for building AI agents) that had been known for roughly a year before the attack.
- Security firm Sygnia separately investigated an AI-assisted break-in to a cloud environment where attackers chained weaknesses across application services, storage, code repositories, and databases.
- University of Toronto researchers built a self-replicating AI worm in early 2025 that autonomously found and exploited weaknesses across dozens of simulated systems.
- The organisations most at risk aren't missing AI defences; they're the ones still relying on human-speed security teams against machine-speed attacks.
For years, companies have been getting better at catching intruders. Security teams trained harder, bought smarter tools. AI is now erasing that progress.
Two investigations, published within days of each other, show that criminals are using AI agents, software programs that can plan and act on their own, to run attacks from the very first move to the final ransom demand, with little or no human involvement.
Sygnia, a security firm, investigated a break-in to a company's cloud environment (remote computer systems rented from a provider rather than owned on-site). Attackers used AI to move at a pace no human security team could comfortably track, each new foothold assessed automatically, the next target selected, the approach adapted on the fly whether it landed on a virtual server, a file-storage bucket, or a software-build pipeline. Sysdig looked at a separate criminal campaign it called JadePuffer, where an autonomous AI agent carried out the whole operation: stealing login credentials, mapping internal services, and locking in multiple access points so the criminals could stay inside even if the victim tried to kick them out. Both cases ended in extortion: pay up, or we release your data and prove we still own your network.
We first covered JadePuffer on 6 July and the Sygnia cloud incident on 8 July; this piece draws on the broader CSO Online analysis of what both cases mean together.
How did the attackers get in?
Neither attack needed exotic, previously unknown security flaws. JadePuffer walked through a door left open for a year: CVE-2025-3248, a flaw in Langflow that is, ironically, designed to help people build AI agents. The Sygnia attackers found an AWS key, a digital credential that unlocks a company's rented cloud resources, sitting exposed inside a web application. From there, AI automation did the rest.
The criminals didn't need genius. They needed patience and a cheap AI subscription.
"The skill floor for running a ransomware operation dropped to the cost of running an agent," Dray Agha of security firm Huntress told CSO Online. More attackers, lower costs, faster strikes.
Should you worry?
Historically, intruders spent weeks quietly exploring a network before striking, giving defenders time to spot them. AI collapses that window. Sygnia's researchers found forensic traces of rapid, repeated activity consistent with automated workflows for credential harvesting and attack-path mapping, letting the intrusion progress across multiple stages in a compressed timeframe.
"The organizations that will struggle aren't the ones lacking AI defenses; they're the ones still relying on human-speed security in a machine-speed threat environment," Gidi Cohen, CEO and co-founder of Bonfy.ai, told CSO Online.
For people whose data sits inside companies facing these threats: watch for unexpected password-reset emails or login alerts, change passwords at any breached service, and turn on two-step verification (where a service sends a second code before letting you log in) wherever it's offered.
For organisations, the defensive answers are less glamorous than AI. Patch known flaws fast, as our 8 July report on the Langflow CISA directive made plain. Rotate credentials regularly. Give staff and systems only the access they actually need. AI-powered detection tools help, but only when they're connected to teams and processes that can act on alerts within the same compressed timeframe the attackers now operate in.
