AI Agents Now Conduct End-to-End Ransomware Attacks Autonomously
A campaign dubbed JADEPUFFER demonstrates AI agents executing ransomware attacks from initial compromise to encryption and ransom demands without human intervention.
Ransomware attacks have entered a new, alarming phase, with researchers documenting a campaign where an AI agent autonomously planned, executed, and escalated an extortion operation without any apparent human oversight or approval. This operation, tracked as JADEPUFFER, leveraged an exposed AI workflow server to steal credentials, access databases, encrypt records, and issue ransom demands. The campaign further deployed a specialized locker targeting AI-specific files, significantly increasing the risk to artificial intelligence systems.
Analysts at SOCRadar noted that this development does not rely on novel attack methods but rather combines familiar vulnerabilities—such as exposed services, unpatched systems, default credentials, and poorly protected secrets—with an AI agent capable of assessing results and adapting its approach at machine speed. This signifies a critical shift, moving attacks beyond the pace of human operators and shrinking the window between a minor security failure and catastrophic impact. The concern is not that AI invented ransomware, but its ability to drastically accelerate the timeline of destruction.
JADEPUFFER is classified as agentic ransomware because the AI model performed actions far beyond simple task generation; it executed commands, analyzed outcomes, modified its strategy, and pursued the goal of extortion autonomously. The initial compromise exploited CVE-2025-3248, a critical missing-authentication flaw in Langflow's code-validation endpoint. This vulnerability allows an unauthenticated attacker to execute arbitrary Python code on a vulnerable host, making any exposed Langflow deployment a severe risk.
Upon gaining access, the AI agent systematically searched for sensitive information, including cloud keys, API credentials, wallet seed phrases, database connection details, and stored data. It identified a MinIO service using default credentials, established persistent access, and utilized compromised host information to access MySQL and Alibaba Nacos services. The agent's actions demonstrated sophisticated autonomy, including fixing a failed login within 31 seconds, forging a token using a public default Nacos signing key, and creating a backdoor administrator account.
Following the credential theft and system access, the agent proceeded to encrypt 1,342 configuration records, delete the original tables, and leave a ransom demand. Researchers observed over 600 purposeful payloads deployed in a compressed timeframe, accompanied by natural-language comments explaining the agent's actions and evidence of retained context across sessions. These indicators strongly support the assessment that an AI agent was orchestrating the entire campaign.
Further analysis revealed that JADEPUFFER later returned with ENCFORGE, a custom locker designed to target approximately 180 file extensions commonly found in AI and machine-learning environments. This specific focus on model checkpoints, vector databases, embedding indexes, and training datasets highlights critical assets that traditional backup and recovery strategies may overlook, posing a unique threat to organizations heavily invested in AI development.
While not all ransomware events are fully autonomous, as demonstrated by intermediate models where AI assists in exploit research and playbook creation while humans execute intrusions, both scenarios reduce the time and expertise required for attackers to cause significant harm. Agents can recover from failed commands, process vast amounts of data, and operate continuously without the delays or errors that might expose human attackers.
Organizations must urgently identify and secure internet-reachable AI workflow platforms, code-execution endpoints, administration panels, and data stores. This includes prompt patching of vulnerabilities like CVE-2025-3248, enforcing strong multi-factor authentication, eliminating default credentials, and ensuring secrets like API keys and cloud credentials are not stored in web-accessible configuration files. Furthermore, robust backup strategies must encompass AI-specific assets, and incident response plans should account for the possibility of an attacker moving from initial access to widespread damage within hours.