---
title: First Documented Agentic Ransomware Attack Logged by Sysdig
description: AI agent autonomously executes a ransomware attack, exploiting a Langflow flaw to target servers. Sysdig warns of rising threats.
canonical_url: https://codekeeper.co/ticker/ai-agent-manages-ransomware-attack
---

# First Documented Agentic Ransomware Attack Logged by Sysdig

AI agent autonomously executes a ransomware attack, exploiting a Langflow flaw to target servers. Sysdig warns of rising threats.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jul 8, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-agent-manages-ransomware-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-agent-manages-ransomware-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-agent-manages-ransomware-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-agent-manages-ransomware-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-agent-manages-ransomware-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-agent-manages-ransomware-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybersecurity firm Sysdig has documented what it calls the first agentic ransomware attack — where an AI agent autonomously ran an entire extortion operation, from reconnaissance and credential theft through lateral movement, encryption, data destruction and the ransom note. The late June 2026 attack, attributed to a financially motivated group called JadePuffer, exploited Langflow flaw CVE-2025-3248 to reach a MySQL and Alibaba Nacos production server. The agent ran over 600 payloads, self-corrected an error in 31 seconds, and tapped models from OpenAI, Anthropic, DeepSeek and Gemini. The autonomy had limits worth noting. A human provisioned the infrastructure, configured the command-and-control server, picked the victim, and supplied root credentials obtained in an earlier compromise — the agent took it from there. "The skill floor for running a full ransomware operation just dropped to whatever it costs to run an agent," warned Michael Clark, Sysdig's senior director of threat research. Anyone running Langflow should confirm CVE-2025-3248 is patched. **Source:** [CyberScoop](https://cyberscoop.com/sysdig-judepuffer-ai-agentic-ransomware-attack/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-agent-manages-ransomware-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-agent-manages-ransomware-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-agent-manages-ransomware-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-agent-manages-ransomware-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-agent-manages-ransomware-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-agent-manages-ransomware-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Ransomware New 'SynkLoader' Malware Could Be Paving the Way for Ransomware Attacks Aug 25, 2026](https://codekeeper.co/ticker/synkloader-malware-phishlocker-sso-breach)

[OpenAI's Rogue AI Hacked Multiple Services, Not Just Hugging Face Aug 11, 2026](https://codekeeper.co/ticker/rogue-ai-hacks-hugging-face-and-more)

[![FBI arrests Canadian in Pennsylvania linked to ShinyHunters hack, part of efforts to dismantle the group after breaching FBI data.](https://codekeeper.co/hubfs/_sized/Generated%20Blog%20Post%20Images/fbi-arrests-canadian-in-shinyhunters-hack-800.png) Cyberattacks New Arrest in the Hunt for the FBI Jobs Site Hackers Oct 12, 2026](https://codekeeper.co/ticker/fbi-arrests-canadian-in-shinyhunters-hack)

[Cyberattacks Hit Over 30 Minnesota Water Systems as Iranian Hackers Suspected Aug 11, 2026](https://codekeeper.co/ticker/minnesota-water-systems-cyberattack-iranian-hackers)