The cybersecurity industry has warned for years that AI would sooner or later lower the bar for serious crime. This week, the warning stopped being theoretical. Sysdig has published a detailed forensic review of a named attackJADE BUFFER— the first documented ransomware operation performed almost entirely by an autonomous AI agent, without a human directing every step.
So the attack took place
The breach began in a familiar way: an Internet-exposed Langflow server with a known vulnerability, CVE-2025-3248. From there, an AI agent took over — conducting reconnaissance, stealing credentials, moving laterally in the network, escalating permissions, and finally reaching a production database, where it encrypted over 1,300 configuration records and deleted the originals.
That's how the researchers know it was AI
What convinced Sysdig was the "voice" of the attack. The payloads were filled with plain-language commentary in which the AI explained its own reasoning — which database looked most valuable, why a certain goal was prioritized, what each step would accomplish. That kind of ongoing self-explanation is a characteristic of code generated by a real-time language model; human attackers don't normally comment out their OTP like that. Equally telling was the adaptability: in one sequence, the agent went from a failed login attempt to a working exploit in 31 seconds, quietly tweaking its own parameters until something worked.
The ransom that could never be paid
There's a darkly comic twist to how the blackmail itself was built. The encryption key was generated from pure random data and was only printed to a console log — it was never saved or sent anywhere. Thus, paying the ransom would not give the victim their data back, as the AI agent never kept the key required to unlock it. Whether it was a deliberate design flaw or a pure mistake in an otherwise highly competent attack chain, it underscores a real risk with AI-powered crime: even the attacker doesn't have to fully understand what the agent was actually doing.
Why this matters
What makes JADEPUFFER important is not the size of the attack — it's what it says about the threshold for carrying out a serious cyberattack. Chaining together espionage, credential theft, lateral movement and destruction previously required deep expertise in multiple specialty areas. JADEPUFFER demonstrates that a single operator with access to a capable AI agent can now orchestrate the entire chain, while the AI fills in the technical gaps in real time. In the same week, the European Commission presented its new Cybersecurity and Artificial Intelligence Action Plan, aimed at exactly this type of AI-native threat. Both the plan and JADEPUFFER will be referenced in security discussions for a long time to come.
