Security firm Sysdig says it has documented what it believes is the world's first ransomware attack carried out entirely by an AI agent, from initial breach to final encryption, without a human operator directing any step. The group behind it, which Sysdig tracks as JADEPUFFER, exploited a known remote-code-execution vulnerability in Langflow — an open-source tool widely used to build AI agent workflows — to gain their foothold.

What happened next is the part that should grab your attention. Once inside, a large language model handled the full attack chain: harvesting credentials, moving laterally through the network, then encrypting and wiping a production database. The LLM didn't just assist — it drove. Sysdig's Threat Research Team says this is qualitatively different from previous AI-assisted attacks where a human still called the shots at key decision points.

Why this matters more than the usual "AI used in cyberattack" headline.

We've had plenty of those already — AI-drafted phishing emails, AI-accelerated reconnaissance. JADEPUFFER is different because it removes the human bottleneck entirely. Traditional ransomware operations require skilled operators making judgment calls at each stage: which credentials to try, which systems to pivot to, when to detonate. If an LLM can reliably substitute for that expertise, the economics of ransomware change dramatically. You no longer need a team of experienced hackers. You need a prompt and a target list.

There's also a nastier wrinkle: Sysdig notes the AI agent didn't reliably return data even after a ransom payment was made. That's not a bug from the victim's perspective — it's the same unreliability that makes trusting any ransomware negotiation a bad bet. But it does suggest that agentic ransomware may be even harder to negotiate with than human-operated variants.

The Langflow angle matters too.

CVE-2025-3248 — the Langflow RCE that JADEPUFFER exploited — was patched back in April 2025, but Langflow instances remain widely unpatched across the internet. If you're running any AI orchestration tooling in your environment, this is a good reminder that the attack surface isn't just your traditional infrastructure. The pipelines you use to build AI agents are themselves exploitable entry points.

What to watch for.

Sysdig is careful to call this a first confirmed instance, not evidence of widespread deployment. But the proof-of-concept value here is significant: someone has now demonstrated the technique end-to-end, which means others will iterate on it. Expect defenders to push back hard on the "first ever" framing — there's reasonable debate about what counts as "fully autonomous" — but that debate shouldn't obscure the underlying signal.

For Australian organisations, this is worth flagging in the context of the ACSC's recent guidance on AI system security. Agentic AI tools are proliferating across enterprise environments, and most security teams haven't fully mapped them into their threat models. If Langflow or similar orchestration platforms are running in your environment, check your patch status today — and then ask whether those systems are even in your asset inventory.