The ‘first’ AI-run ransomware attack still needed a human

 

Last week, cloud security firm Sysdig documented what it called the first known case of agentic ransomware: an extortion operation dubbed JadePuffer, where an AI agent handled the technical execution of a real cyberattack from start to finish. Early coverage described it as running "without any human oversight" and with "no human at the keyboard."

That framing needed a correction, and Sysdig's own senior director of threat research, Michael Clark, provided it directly in a follow-up interview. A human was still very much involved, just not in the technical execution. Someone set up and pointed the entire operation, provisioned the command-and-control infrastructure and the staging server for stolen data, and chose the victim. The credentials used to break into the target's database weren't harvested by the agent either. They came from a separate prior compromise and were handed to the operation.

None of that makes the technical execution any less notable. The agent exploited a known bug in Langflow, a popular open-source tool for building LLM apps, then pivoted to a production MySQL server and used another known flaw to gain admin access. It encrypted over 1,300 configuration records, wrote its own ransom note, and left behind a Bitcoin address for payment. What stood out to researchers wasn't novel technique, it was speed and transparency. The agent fixed a failed login in 31 seconds, narrating its own reasoning in natural-language code comments the entire time.

One detail initially made the story murkier than it needed to be. Clark had mentioned "multiple models were used in the attack," citing harvested API keys for OpenAI, Anthropic, DeepSeek, and Gemini. That phrasing left open the impression that several models were actively powering different stages of the intrusion. When TechCrunch followed up, Clark clarified that those keys were simply part of what the agent stole while sweeping the compromised host for anything valuable, alongside cloud credentials and crypto wallets. They show what the attacker considered worth taking, not which model was actually making decisions. Sysdig, in fact, could not identify the specific model driving the agent and has no visibility into its system prompt or configuration.

That gap matters for a theory Microsoft researcher Geoff McDonald floated days earlier on LinkedIn. McDonald suspected the agent was likely running on an open-weight model with safety training stripped out, rather than a frontier model, based on his own red-teaming experience showing frontier labs' safety layers generally hold up under this kind of pressure. Sysdig's account neither confirms nor rules that out.

McDonald also warned that ransomware campaigns are now bounded mainly by attacker budget rather than human effort, raising the possibility of thousands of simultaneous campaigns running at once. That concern sits a little uneasily next to what Clark actually described. If a human still has to select each victim, provision new infrastructure, and separately obtain database credentials for every single operation, that's still a meaningful bottleneck, at least for now.

Sysdig hasn't seen this same operation hit other victims yet. But given how cheap it is to run an agent once the setup exists, Clark expects that to change.

The real story here isn't "AI can run a cyberattack alone." It's narrower and arguably more useful to understand correctly: AI can now execute the technical middle of an attack with real autonomy, while a human still handles the strategic decisions on either end. That's a meaningfully different threat model than full automation, and it changes what defenders should actually be watching for.

Does the human-in-the-loop bottleneck reassure you, or does the technical execution piece alone feel like enough of a shift to worry about?