The First Fully Autonomous AI Ransomware Just Ran an Entire Attack With No Human at the Keyboard. Here's the 20-Minute Check That Keeps Your VPS Off the Target List.

Sysdig's threat research team published an attack they're calling JADEPUFFER, and the detail that matters isn't the ransom note. It's the timestamp. When the agent hit a failed login on a Nacos backdoor-admin sequence, the gap between that failure and the correct multi-step fix was 31 seconds. No human types that fast across an unfamiliar config. That's a machine reasoning through an error and trying again, and it ran the whole attack that way (recon, credential theft, lateral movement, privilege escalation, persistence, and database encryption) end to end.

Sysdig assesses it as the first documented case of ransomware driven entirely by a large language model agent. Not "AI-assisted." Not a human running a copilot. An agent making the decisions.

If you run a VPS with anything internet-facing on it, this is the story that should change how you spend the next 20 minutes.

What actually happened

The agent got in through an internet-facing Langflow instance using CVE-2025-3248, a known vulnerability in that tool. From there it pivoted to the intended target and ran a destructive database-extortion playbook against the production database server.

The decoded payloads are the interesting part. They're saturated with natural-language commentary explaining why each action was taken: ROI prioritization of which target to hit, identification of the "largest" database, a running justification for each step. You're reading an attacker's reasoning out loud, because the attacker is a language model narrating its own plan.

It encrypted 1,342 Nacos service configuration items and deleted the originals. Here's the cruel part: the AES key was generated as essentially random, printed to stdout, and never persisted or transmitted anywhere. The victim can't recover the encrypted configs even if they pay, because the key that would decrypt them was never saved. Whether that was a bug in the agent's logic or a deliberate scorched-earth move, the outcome is the same: this wasn't extortion you can buy your way out of.

Why the 31 seconds is the whole story

Every "AI is going to change security" post for the last two years has been abstract. This one has a number. Thirty-one seconds from a failed login to a working multi-step fix is what tireless, adaptive, cheap automation looks like when it's pointed at your infrastructure.

The old mental model was that you're safe because you're small. Nobody's going to spend a skilled operator's afternoon manually poking at a solo founder's $12/month droplet. That model is dead. When the operator is an agent that costs pennies per host and never gets bored, "not worth a human's time" stops being a defense. The economics flipped. Scanning the entire internet and adaptively exploiting whatever answers is now something you point a model at and walk away from.

I run a handful of small boxes for side projects. My honest reaction reading the Sysdig writeup wasn't "how do I detect a language model in my logs." It was "which of my forgotten dashboards is exposed right now."

The check that actually matters

You're not going to out-engineer an autonomous agent this weekend. What you can do is remove yourself from the pool of easy answers. JADEPUFFER didn't need a zero-day: it walked in through an internet-facing dev tool with a known CVE. That's the pattern, and it's fixable.

Inventory what you've got listening on a public IP. Not what you think is running: what's actually bound to 0.0.0.0. On each box:

sudo ss -tlnp | grep -v '127.0.0.1\|::1'

Anything in that list that's an admin panel, an agent framework, or a database is your exposure. Langflow, Nacos, n8n, a stray Grafana, a Postgres you meant to bind to localhost, an old Jupyter notebook: these are exactly the "internet-facing dev tool with a known CVE" shape that JADEPUFFER used. Close them, put them behind a VPN or a Tailscale tunnel, or at minimum kill anonymous access and patch to current.

Then rotate anything those services could have touched. If an exposed tool had database credentials in its config, assume they're compromised and cycle them.

None of this is new advice. What's new is the cost of ignoring it. The window between "I'll get to it" and "an agent got to it first" used to be measured in your relative obscurity. Now it's measured in how fast a model can scan and adapt, which the Nacos sequence tells us is roughly half a minute per obstacle.

The honest take

I want to be careful not to oversell this. JADEPUFFER is one documented operation, and Sysdig is a security vendor with a product to sell: "first fully autonomous AI ransomware" is a headline that moves subscriptions. It's fair to ask how much of the attack was genuinely novel versus a well-orchestrated agent stitched onto tactics that already worked. The initial access was a known CVE in a tool you shouldn't have exposed anyway. The lateral movement was standard. In a real sense, the defenses haven't changed: don't expose admin panels, patch your stuff, rotate credentials.

But that's also the point. The reason this attack worked is the same reason it's been working for a decade: someone left a dev tool on a public IP. What changed is that the attacker is now a process you can run at internet scale for the price of tokens. The bar to being targeted dropped to zero.

So the recommendation isn't to buy a new product. It's to spend 20 minutes with ss -tlnp on every box you own this week, close what shouldn't be open, and stop assuming your size is a moat. It was never much of one, and it's gone now.

Author

Lukas

@lukcombinator

Sources

• JADEPUFFER: Agentic ransomware for automated database extortion (Sysdig)
• JadePuffer ransomware used AI agent to automate entire attack (BleepingComputer)
• JadePuffer: The First Complete LLM-Driven Ransomware Attack (Dark Reading)
• Researchers Claim First Fully Agentic Ransomware: JadePuffer (Infosecurity Magazine)