First autonomous AI ransomware hacks corporate network
What it really says
Security firm Sysdig has published the first documented case of a fully autonomous ransomware attack driven end-to-end by an AI agent. The attacker, dubbed JADEPUFFER by Sysdig, used a Large Language Model (LLM) that independently carried out the entire attack: from initial access through a known vulnerability (CVE-2025-3248 in the open-source software Langflow), through credential theft and lateral movement across the network, to encrypting 1,342 configuration items in a production database and leaving a ransom demand. Notably, the AI agent adapted in real-time. When an initial login attempt failed, it found an alternative solution within 31 seconds. The payloads contained natural-language self-commentary typical of LLM-generated code. TechCrunch emphasizes, however, that a human must have initially configured the agent and defined its targets.
Our assessment
An AI agent hacked a corporate network, stole credentials, encrypted 1,342 database entries, and left a ransom note. All autonomously, without human control during the attack. This is a real milestone in cybercrime that deserves serious attention. The barrier for complex attacks is dropping: what previously required teams of experienced hackers can now be performed by an AI agent alone. Context matters though: the attack exploited a vulnerability known and patched for over a year (CVE-2025-3248). Anyone keeping systems updated would not have been affected. Additionally, the encryption was technically flawed. The AES key was generated but never stored or transmitted anywhere. Even with payment, the victim could not have recovered their data. This shows: AI agents can automate attacks, but their quality is (still) not at the level of experienced hacking groups.
Relevance for Germany
This news is relevant for German companies for several reasons. First, the attack vector (unpatched open-source software) is widespread in German corporate networks. The BSI regularly warns about exactly such scenarios. Second, AI automation means attackers can target many victims simultaneously without human capacity constraints. For small and medium enterprises that were previously 'too unimportant' for targeted attacks, the risk increases. Third, the EU Cyber Resilience Act and the NIS-2 Directive, implemented in Germany through the NIS2UmsuG, already require companies to maintain rapid patch management. JADEPUFFER demonstrates why this obligation provides concrete protection rather than mere bureaucracy. Fourth, the BSI should incorporate AI-powered attack methods into its situation reports and recommendations.
Fact check
The analysis comes from Sysdig's Threat Research Team, an established cloud security company. The full technical report with indicators (C2 server, Bitcoin address, CVE references) is publicly available. BleepingComputer, Dark Reading, The Hacker News, and SecurityWeek report consistently. TechCrunch provides the important caveat that a human must have initially configured the agent. The exploited vulnerability CVE-2025-3248 (CVSS 9.8) was patched in April 2025 and added to CISA's KEV catalog in May 2025. Sysdig's assessment as the 'first documented case' refers to end-to-end autonomy; earlier AI-assisted attacks used LLMs only for sub-steps like phishing text or code generation.
Source
- • https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion
- • https://techcrunch.com/2026/07/06/the-first-ai-run-ransomware-attack-still-needed-a-human/
- • https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/
- • https://www.darkreading.com/cyberattacks-data-breaches/jadepuffer-first-complete-llm-driven-ransomware-attack