Kiran 
Cybersecurity has just crossed a line researchers have warned about for years: ransomware that runs itself.
In July 2026, Sysdig’s Threat Research Team confirmed the first fully autonomous extortion campaign, an operation dubbed JADEPUFFER, in which an AI agent, not a human affiliate, planned, executed, and monetized an intrusion from start to finish.
It’s a milestone that reframes how defenders should think about ransomware‘s next chapter. Ransomware has traditionally required someone in the chain.
Agentic Ransomware Arrives
Microsoft’s own term, “human-operated ransomware,” described skilled affiliates manually pivoting through networks before deploying a payload. Groups like Conti and BlackCat/ALPHV built entire franchise economies around that human skill.
That began shifting with AI-assisted ransomware, where operators used large language models to draft phishing lures or generate code snippets useful, but still directed step-by-step by a human.
FortiBleed, an active credential-harvesting campaign linked to the INC and Lynx ransomware groups, pushed further. An affiliate known as TOXMAN built a 14-agent framework called PENTEST LAB that autonomously hunted zero-days and validated CVEs across Fortinet, Active Directory, and ESXi environments, generating attack playbooks that human operators then used to breach over 86,600 devices across 194 countries.
JADEPUFFER went a step further, removing the human entirely. The agent exploited CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow, an open-source AI agent-building platform.
From there, it harvested credentials, pivoted to an exposed MySQL and Nacos server, forged authentication tokens, and encrypted 1,342 configuration records, diagnosing and fixing a failed login in just 31 seconds.
Sysdig based its assessment on self-narrating code comments, machine-speed error correction, and cross-session contextual awareness that pointed unmistakably to an LLM driving the operation.
By July 20, the same operator escalated with a new locker, ENCFORGE, targeting roughly 180 file types across the AI/ML stack: model checkpoints, vector databases, and embedding index assets that can cost $75,000 to $500,000 to rebuild if destroyed, and that routine backups often don’t cover.
“What makes JADEPUFFER unsettling isn’t the exploit chain; it’s the humility gap. Organizations have spent a decade building incident response plans that assume they have hours to react.
An agent that self-corrects in 31 seconds doesn’t care about your escalation matrix,” says sysdig, a cybersecurity analyst. “The real vulnerability isn’t Langflow’s code-validation endpoint; it’s the assumption that attackers still think and move like humans.”
Neither campaign relied on novel techniques; exposed endpoints, default credentials, and known CVEs remain the entry points. What’s changed is velocity and accessibility: a few thousand dollars in API credits can now replicate what once took a skilled penetration-testing crew weeks to build.
Security teams should treat AI orchestration platforms and agent frameworks as Tier-1 assets, pull code-execution endpoints off the public internet, eliminate default credentials on storage and configuration systems, and extend immutable backups to model checkpoints and training data.
Detection logic also needs retuning to watch for rapid, self-correcting command sequences rather than only known malware signatures.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
