First Fully Autonomous AI Agent Executes End-to-End Ransomware Attack Without Human Intervention

Cloud security firm Sysdig reported it detected the first documented end-to-end agentic ransomware operation, an actor it tracks as JADEPUFFER, gaining initial access to an internet-facing Langflow server through CVE-2025-3248 and then autonomously executing reconnaissance, credential theft, lateral movement, and privilege escalation without human direction 12. From the Langflow host, the agent harvested credentials and pivoted to a separate production server running MySQL and Alibaba's Nacos platform, exploiting CVE-2021-29441 and Nacos's default JWT signing key to inject a backdoor administrator account 13. Sysdig said the agent encrypted 1,342 Nacos configuration records using MySQL's AES_ENCRYPT function, deleted the original tables, and left a Bitcoin ransom note; when an initial attempt to create the admin account failed, the agent diagnosed the error and issued a working correction within 31 seconds 123. Sysdig said it found no evidence the attackers retained a decryption key or backup, and BankInfoSecurity noted the intrusion coincided with a Five Eyes joint statement warning that AI-driven cyberthreat capability is "months," not years, away 2.