--- title: The ‘first’ AI-run ransomware attack still needed a human description: Sysdig's JadePuffer case — billed as the first AI-run ransomware attack — is more nuanced than initial headlines suggested. While an AI agent autonomously... canonical: https://daily.dev/posts/the-first-ai-run-ransomware-attack-still-needed-a-human-cpxib3mqk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The ‘first’ AI-run ransomware attack still needed a human | daily.dev og:description: Sysdig's JadePuffer case — billed as the first AI-run ransomware attack — is more nuanced than initial headlines suggested. While an AI agent autonomously... og:url: https://daily.dev/posts/the-first-ai-run-ransomware-attack-still-needed-a-human-cpxib3mqk og:image: https://api.daily.dev/og/posts/cPXiB3mQK.png og:image:alt: The ‘first’ AI-run ransomware attack still needed a human og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The ‘first’ AI-run ransomware attack still needed a human **[TechCrunch](https://daily.dev/sources/tc)** · 4 min read · 0 upvotes · 0 comments ## Summary Sysdig's JadePuffer case — billed as the first AI-run ransomware attack — is more nuanced than initial headlines suggested. While an AI agent autonomously handled technical execution (exploiting a Langflow vulnerability, moving laterally to a MySQL server, encrypting 1,300+ records, and writing its own ransom note), a human still selected the victim, provisioned infrastructure, and supplied pre-stolen credentials. The agent's speed was notable — fixing a failed login in 31 seconds while narrating its own reasoning. Sysdig could not identify the specific model powering the agent. A Microsoft researcher theorized it used a stripped open-weight model rather than a frontier model, and warned that ransomware campaigns may soon scale to thousands of simultaneous operations, though human bottlenecks in victim selection and infrastructure setup remain a limiting factor for now. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Did the JadePuffer AI ransomware attack run completely without human involvement? No, a human was still involved despite early reports describing it as fully autonomous. A person chose the victim, provisioned the command-and-control and staging infrastructure, and supplied stolen database credentials obtained through a separate prior compromise, while the AI agent handled the technical execution: breaking in, encrypting files, and writing its own ransom note. _Security teams evaluating AI-driven attack risk can follow evolving threat research like this on daily.dev._ ### How did the JadePuffer ransomware agent gain initial access to the victim's systems? The agent exploited a known bug in Langflow, a popular open-source tool for building LLM apps, then pivoted to a production MySQL server and used another known vulnerability to gain admin access. It went on to encrypt over 1,300 configuration records and left behind a self-written ransom note with a Bitcoin payment address. _Developers securing LLM app infrastructure like Langflow can track disclosed exploit patterns on daily.dev._ ### Could the OpenAI, Anthropic, DeepSeek, and Gemini API keys found in the JadePuffer attack reveal which AI model powered it? No, those provider keys were simply stolen loot swept up from the compromised Langflow host along with cloud credentials and crypto wallets, not evidence of which model drove the agent's decisions. Sysdig said it could not identify the specific model behind the attack and had no visibility into its system prompt or configuration. _Anyone weighing which AI models pose the greatest misuse risk can follow this kind of forensic detail on daily.dev._ ## Similar posts on daily.dev - [AI agent ran a full ransomware attack solo, Sysdig says](https://daily.dev/posts/ai-agent-ran-a-full-ransomware-attack-solo-sysdig-says-fkl5ap8hg) · The Next Web · 0 upvotes · 0 comments - [This AI agent autonomously hacked a network, adapted on the fly, and demanded a ransom](https://daily.dev/posts/this-ai-agent-autonomously-hacked-a-network-adapted-on-the-fly-and-demanded-a-ransom-u3norexvg) · CSO Online · 0 upvotes · 0 comments - [AI agent runs first end-to-end ransomware attack](https://daily.dev/posts/ai-agent-runs-first-end-to-end-ransomware-attack-ulfxi7gog) · The Next Web · 1 upvotes · 0 comments - [JadePuffer Demonstrates How AI Agents Can Automate Ransomware Attack](https://daily.dev/posts/jadepuffer-demonstrates-how-ai-agents-can-automate-ransomware-attack-yxxnlhy7h) · Security Boulevard · 0 upvotes · 0 comments - [JadePuffer: The First Successful LLM-Driven Ransomware Attack](https://daily.dev/posts/jadepuffer-the-first-successful-llm-driven-ransomware-attack-ttpa7zod8) · Dark Reading · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#ransomware](https://daily.dev/tags/ransomware), [#sysdig](https://daily.dev/tags/sysdig) [View this post on daily.dev](https://daily.dev/posts/the-first-ai-run-ransomware-attack-still-needed-a-human-cpxib3mqk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The ‘first’ AI-run ransomware attack still needed a human","url":"https://daily.dev/posts/the-first-ai-run-ransomware-attack-still-needed-a-human-cpxib3mqk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-first-ai-run-ransomware-attack-still-needed-a-human-cpxib3mqk"},"datePublished":"2026-07-06T23:59:45.195Z","dateModified":"2026-09-14T08:55:29.285Z","description":"Sysdig's JadePuffer case — billed as the first AI-run ransomware attack — is more nuanced than initial headlines suggested. While an AI agent autonomously...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d40d1ea44f2eb72120faaba8ef080e2d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d40d1ea44f2eb72120faaba8ef080e2d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"TechCrunch","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"TechCrunch","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tc","url":"https://daily.dev/sources/tc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-first-ai-run-ransomware-attack-still-needed-a-human-cpxib3mqk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,ai-agents,ransomware,sysdig","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"TechCrunch","item":"https://daily.dev/sources/tc"},{"@type":"ListItem","position":3,"name":"The ‘first’ AI-run ransomware attack still needed a human"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-first-ai-run-ransomware-attack-still-needed-a-human-cpxib3mqk#faq","mainEntity":[{"@type":"Question","name":"Did the JadePuffer AI ransomware attack run completely without human involvement?","acceptedAnswer":{"@type":"Answer","text":"No, a human was still involved despite early reports describing it as fully autonomous. A person chose the victim, provisioned the command-and-control and staging infrastructure, and supplied stolen database credentials obtained through a separate prior compromise, while the AI agent handled the technical execution: breaking in, encrypting files, and writing its own ransom note. Security teams evaluating AI-driven attack risk can follow evolving threat research like this on daily.dev."}},{"@type":"Question","name":"How did the JadePuffer ransomware agent gain initial access to the victim's systems?","acceptedAnswer":{"@type":"Answer","text":"The agent exploited a known bug in Langflow, a popular open-source tool for building LLM apps, then pivoted to a production MySQL server and used another known vulnerability to gain admin access. It went on to encrypt over 1,300 configuration records and left behind a self-written ransom note with a Bitcoin payment address. Developers securing LLM app infrastructure like Langflow can track disclosed exploit patterns on daily.dev."}},{"@type":"Question","name":"Could the OpenAI, Anthropic, DeepSeek, and Gemini API keys found in the JadePuffer attack reveal which AI model powered it?","acceptedAnswer":{"@type":"Answer","text":"No, those provider keys were simply stolen loot swept up from the compromised Langflow host along with cloud credentials and crypto wallets, not evidence of which model drove the agent's decisions. Sysdig said it could not identify the specific model behind the attack and had no visibility into its system prompt or configuration. Anyone weighing which AI models pose the greatest misuse risk can follow this kind of forensic detail on daily.dev."}}]} ```