An AI Agent Broke Into a Server, Taught Itself to Adapt, and Left a Ransom Note

Key points

• Sysdig researchers published findings in 2025 describing what they call the first documented end-to-end ransomware attack driven entirely by an AI agent.
• The AI program, named JadePuffer, exploited CVE-2025-3248, a flaw in Langflow (a tool for building AI-powered applications) that lets attackers run any code they like on an exposed server.
• JadePuffer encrypted 1,342 configuration records, deleted the originals and left behind a Bitcoin ransom demand.
• The agent recovered from a failed attempt to create an administrator account in just 31 seconds, without any human stepping in.
• Independent researchers call the attack an evolution in how ransomware works, not the invention of a brand-new threat.

A software tool called Langflow had a known security hole. Security researchers at Sysdig watched an AI agent walk straight through it.

The flaw is tracked as CVE-2025-3248. It is a remote code execution vulnerability, meaning anyone who finds an unpatched, internet-facing Langflow server can send it instructions and the server will obey. JadePuffer, the name Sysdig gave the AI agent, used that hole as its front door. We first reported on this vulnerability on 2 July 2026, when Sysdig published its initial findings.

How did the AI actually carry out the attack?

Once inside, JadePuffer didn't wait for orders. It scanned the internal network, then moved to a production server running MySQL (a popular database program) and Alibaba's Nacos (a platform that stores configuration settings for applications). It harvested stored credentials before encrypting 1,342 Nacos records, wiping the originals, and dropping a Bitcoin ransom note.

Every instruction the agent sent arrived as a small Python script hidden inside Base64 encoding, a way of disguising data as plain text to slip past basic filters. Sysdig counted more than 600 such payloads across the operation.

What caught researchers' attention was the code itself. Each script contained written-out reasoning, almost like notes to itself, explaining what it was trying to do and why. That self-narrating style is a hallmark of code written by large language models, the same technology behind AI chat tools. When one step failed, the agent diagnosed the problem and generated a corrected script, recovering from a failed admin-account creation in 31 seconds.

Should you worry?

"Attackers have automated reconnaissance and deployment for years," independent security researcher Vibhum Dubey told CSO Online. "The difference is that an AI agent can connect those stages together and make decisions without waiting for a human operator."

Dubey's bigger concern isn't the final encryption stage but the quiet period before it, when the agent maps identities, privileges and trust relationships while trying to avoid triggering alarms. That's harder to defend against than a known payload signature.

Prashant Sharma, a cybersecurity consultant at Cyble, told CSO Online the attack is an evolution rather than a revolution. Modern EDR and XDR platforms, he notes, flag suspicious behaviour regardless of whether a human or an algorithm is behind it.

For most organisations, the practical lesson is narrow. If your employer runs software that stores credentials or configuration data, and that software is reachable from the internet, an uninstalled patch is an open invitation. Ransomware no longer needs a criminal at a keyboard.