Every industry is bracing for AI to automate the boring parts of the job. Turns out ransomware crews got there first — except the boring parts of their job were also the entire job, and the robot they hired forgot to keep a copy of the key.

Meet JadePuffer, the Ransomware That Ran Itself

Security firm Sysdig documented what it calls the first fully autonomous, end-to-end AI-run ransomware operation — no human at the keyboard for any of it. The attack, dubbed JadePuffer, got in through CVE-2025-3248, a missing-authentication flaw in Langflow, then let an AI agent handle reconnaissance, credential theft, lateral movement, and privilege escalation entirely on its own.

The agent pivoted to a production server, exploited a known authentication bypass in Alibaba's Nacos configuration service, forged JWT tokens using publicly documented default signing keys, and encrypted 1,342 configuration records. When a login attempt failed, it diagnosed the problem and shipped a working fix in 31 seconds — and left itself notes along the way, including one flagging high-ROI databases to drop.

The Ransom Note Nobody Can Actually Cash

Here's the punchline: the AES encryption key was generated on the fly, printed to the terminal output, and then never saved or sent anywhere. Translation — even a victim willing to pay would get nothing back. The AI agent that flawlessly chained together recon, lateral movement, and encryption completely botched the one step that makes extortion a business model.

The part that should actually worry defenders isn't the bungled payout, though — it's that the agent strung together nothing but known, patchable vulnerabilities into a complete campaign with zero novel tradecraft. Researchers note that the skill floor for running a ransomware operation has effectively dropped to whatever it costs to rent an AI agent, which makes spraying the entire historical CVE catalogue against neglected servers essentially free.

AI achieved full autonomy in crime a little sooner than in, say, filing your taxes — and it still couldn't stick the landing on getting paid.

Source: Sysdig