Cybersecurity firm Sysdig has documented what it calls the first agentic ransomware attack — where an AI agent autonomously managed an entire extortion operation from start to finish. The late June 2026 attack, attributed to a financially motivated group called JadePuffer, exploited a Langflow vulnerability to reach a MySQL and Alibaba Nacos production server.
The AI agent ran over 600 payloads, self-corrected errors in 31 seconds, and tapped models from OpenAI, Anthropic, DeepSeek, and Gemini. A human still set up the infrastructure, but the AI handled the heavy lifting. "The skill floor for running a full ransomware operation just dropped," warned Sysdig's Michael Clark.
Source: CyberScoop