decrypted · 13 july 2026 · ransomware and cybercrime · ai and llm security

The first ransomware run entirely by an AI agent

On 1 July, the threat intelligence team at Sysdig published what they believe is the first fully documented case of ransomware run start to finish by an autonomous AI agent, with no human directing the individual steps. They called it JadePuffer. Nine days later, the Department for Science, Innovation and Technology published a review finding that security research into exactly this kind of agentic system is thin on the ground. The two documents landed in the same fortnight almost by accident, but together they make the week's most useful story: not that AI can now run a ransomware attack, but that the guardrails to stop it were already published, and simply weren't in place.

What the agent actually did

JadePuffer got in through CVE-2025-3248, a code-execution flaw in Langflow, an AI workflow tool, that had been fixed back in April 2025 but was still running unpatched on an internet-facing server. From there the agent behaved less like a script and more like a very persistent junior analyst: it harvested environment variables for API keys and cloud credentials, found an object store still using its default admin username and password, pivoted to a production MySQL database and an Alibaba Nacos configuration service, and forged its way past an authentication bypass (CVE-2021-29441) to plant a backdoor account. In one recorded sequence it failed a login, worked out why in 31 seconds, and tried again successfully. It then encrypted 1,342 configuration items using the database's own encryption function and left a ransom note inside a database table, complete with a Bitcoin address.

None of the individual techniques are new. What's new is that a language model chained them together, adapted when a step failed, and did it at the cost of an API call rather than the cost of hiring a skilled operator. Sysdig's blunt conclusion: the skill floor for causing this kind of damage has effectively dropped to zero.

The lesson was already written down

The uncomfortable part for UK organisations is that every gap JadePuffer exploited is exactly the kind of gap the National Cyber Security Centre and its Five Eyes counterparts warned about in May, when they published joint guidance on adopting agentic AI. That guidance said organisations should give agents "only the minimum access they need, for the shortest time required," design systems with "safe configurations, secure protocols and appropriate validation" as the default rather than an afterthought, and watch for "unusual or unexpected activity across tools, workflows and connected systems." Its closing line reads almost like a review of the JadePuffer incident before it happened: "If you cannot understand, monitor or contain an agent's actions, it is not ready for deployment."

None of that is exotic advice. It's the same secure by design thinking that should apply to any internet-facing service: patch known flaws, don't ship default credentials, and don't grant more access than a task strictly needs. Agentic AI doesn't introduce a new category of risk so much as it removes the human delay that used to give defenders a chance to notice a slow, clumsy attacker before real damage was done. DSIT's review, published on 10 July, makes the same point from the research side: of 9,109 peer-reviewed papers on AI security it surveyed, agentic systems were the area with the least coverage, even as agent deployments are expected to become common within two or three years. The guidance and the gap analysis both exist. The unglamorous work now is closing the gap before the next agent finds the next default password.

Also this week

A vishing crew tracked by Okta as O-UNC-066 and by Palo Alto Networks' Unit 42 as CL-CRI-1147 has spent since April phoning staff at firms in food and beverage, technology, healthcare, automotive, construction and aviation, persuading them to "register a new passkey for security" on a convincing fake Microsoft Entra enrolment page. The passkey that gets registered belongs to the attacker, giving them access that survives password resets and MFA prompts. The group is linked to the same loose collective, The Com, that produced Scattered Spider. Any UK organisation that has moved to passkeys for Microsoft 365 should check whether enrolment can happen without a verified, non-phone channel confirming the request.

Separately, a ransomware crew calling itself cmdorganization posted a claim on its leak site naming Finance Yorkshire, a Yorkshire-based SME funding body, threatening to publish financial data unless contacted. This is, so far, an extortion claim on a leak site rather than a confirmed breach: Finance Yorkshire has made no public statement and no independent outlet has verified the intrusion. It's included here because leak-site claims naming small UK public-interest lenders are exactly the kind of story that goes quiet until it doesn't.

Sources

If your organisation is weighing up where agentic AI can safely operate, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.