How the Attack Ran to Completion
In its analysis published July 6, Sysdig calls this intrusion, codenamed JadePuffer, the first known ransomware attack whose technical execution was handled by an AI agent. The agent used a known Langflow vulnerability (CVE-2025-3248) to gain initial access, pivoted to a production MySQL server running Alibaba's Nacos, exploited a second known vulnerability to obtain admin privileges, and after moving laterally, encrypted over 1,300 configuration records, finally generating its own ransom note—it even filled in the Bitcoin address itself. The most striking detail is a 31-second self-repair: reading an error, swapping a subprocess call for a direct library import, and redeploying—all with no human intervention.
The "Fully Automated" Claim Needs a Discount
TechCrunch's July 6 report puts it bluntly in its headline: this "first AI ransomware attack" still needed humans. It was humans who set the stage—selecting the target, building the command-and-control infrastructure, and providing the credentials to get in. What the agent took over was the part after launch: it didn't need the operator to direct it step by step, but judged, corrected, and pushed forward on its own. "Fully autonomous crime" is an exaggeration, but "the execution stage no longer requires technical skill" is a fact.
What Defenders Should Remember
Both entry points were known vulnerabilities with patches available; this incident didn't demonstrate a new attack technique, but a change in cost structure: the technical barrier to running a ransomware operation has dropped to "being able to afford an agent," and if the agent uses stolen API credentials (LLMjacking), the attacker's marginal cost approaches zero. Patching and properly managing model API credentials both need their priority raised.