The first AI-run ransomware was actually a wiper and its copycats are coming

Twelve days ago researchers at Sysdig documented the first known ransomware operation run entirely by an AI agent. They called it JadePuffer. The security industry called it a milestone. Both things are true. But the most important detail buried in the coverage is that JadePuffer was never ransomware at all. It was a wiper.

The AI agent encrypted 1,342 Nacos service configuration items using MySQL’s AES_ENCRYPT() function, dropped the original tables, and left a ransom note demanding Bitcoin. Standard extortion playbook. Except the AES encryption key was generated from two random UUID4 calls, printed once to the agent’s own log output, and never stored or transmitted to anyone. The attacker has no copy. A victim who pays gets nothing.

That puts JadePuffer in the same functional category as NotPetya, the 2017 wiper disguised as ransomware that caused an estimated $10 billion in global damage. Whether the missing key was a deliberate design choice or the operator failing to instruct the agent to persist it is unknown. Sysdig could not identify the specific model driving the operation, cannot access its system prompt, and has no visibility into intent. The ransom note’s Bitcoin wallet address matched a widely cited documentation example, raising the possibility that the model hallucinated it from training data.

The 31-second self-correction

JadePuffer ran on a ReAct architecture: the same reason-act loop that powers every commercial AI agent framework deployed in enterprises today. The model received the output of each action, reasoned about what it revealed, generated the next step, and continued.

When the agent tried to create a backdoor administrator account inside the target’s Nacos configuration server, the attempt failed because a subprocess call had no PATH access, producing an empty bcrypt hash. The agent read the error, deleted the broken account, switched from subprocess calls to direct library imports, verified the library was available, regenerated the hash, reinserted the account, and confirmed the login worked. Time from failure to fix: 31 seconds.

Michael Clark, Sysdig’s Senior Director of Threat Research, told CyberScoop: “The agent read the error, switched its approach from subprocess calls to direct library imports, and redeployed at a speed no human matches.”

This was not a one-off. When a MinIO object storage server returned XML instead of the expected JSON, the next payload switched parsers. When a DROP DATABASE command failed silently due to a foreign key constraint, the next payload prefixed it with SET GLOBAL FOREIGN_KEY_CHECKS=0. Every failure produced a targeted diagnostic, not a blind retry. The agent ran over 600 autonomous payloads through this loop.

No frontier model required

On July 10, Forbes analyst Ron Schmelzer documented what security researchers had been warning about since the original disclosure: JadePuffer’s architecture is not exclusive to frontier AI models. Open-weight models running on commodity hardware, including models stripped of safety training and distributed through unofficial channels, can run the same ReAct-loop execution that drove JadePuffer’s attack chain.

This matters because it removes the last structural barrier to widespread adoption. An operator running JadePuffer-equivalent logic on a locally hosted model has no billing account to terminate, no provider policy to trigger, and no abuse detection system to evade. According to CSIS, Chinese-developed models including GLM, DeepSeek, Qwen, and Kimi have closed much of the gap with US frontier systems for general reasoning tasks as of July 2026. That is precisely the class of tasks an agentic attack chain requires.

The human operator still provisions infrastructure, chooses a target, and sources initial credentials. The AI handles every technical decision after that, including real-time failure diagnosis and payload correction.

Doors left open for over a year

JadePuffer used no zero-days. The vulnerabilities it exploited had been publicly documented, patched, and in one case added to a government watchlist more than a year before the attack.

Initial access came through CVE-2025-3248, a CVSS 9.8 unauthenticated remote code execution flaw in Langflow, the open-source framework used to build LLM-powered applications. Missing authentication on Langflow’s code validation endpoint invoked Python’s exec() on user-supplied code with no sandboxing. Langflow patched it in version 1.3.0, released March 31, 2025. CISA added it to the Known Exploited Vulnerabilities catalog on May 5, 2025.

The exploited server had not been updated in over a year.

On July 7, 2026, CISA updated CVE-2025-3248’s KEV entry to reflect “known ransomware campaign use.” That was the first time an AI agent platform appeared in the agency’s vulnerability catalog with that designation. The remediation deadline for federal civilian agencies under Binding Operational Directive 26-04 was July 10. It has passed.

Recorded Future’s Insikt Group documented approximately 1,050 internet-exposed Langflow instances on Shodan at the time of the attack. Techzine reported closer to 7,000 reachable instances as of March 2026. Different methodologies, same structural problem.

The detection signal humans never leave

Every payload JadePuffer executed was generated at runtime by the LLM. There were no malware signatures to detect. But the agent left behind something human attackers almost never produce: verbose natural-language commentary inside every payload, explaining targeting rationale, priority logic, and step-by-step objectives.

Language models annotate their own code reflexively. A human writing disposable attack payloads does not. Sysdig cited this self-narrating behavior as one of four independent indicators that JadePuffer was AI-driven.

Independent red teamer Vibhum Dubey told CSO Online that behavioral detection is the only mechanism that can catch agentic attacks. “Traditional detections assume attackers follow fairly predictable paths. An AI agent can quickly change tactics if something is blocked, making every intrusion look slightly different.”

Heath Renfrow, CISO at breach recovery firm Fenix24, told Infosecurity Magazine: “If an AI agent can compress what previously took an experienced operator several hours into a matter of minutes, defenders lose valuable time. That has implications across every phase of an incident, from detection and containment to recovery.”

The cost is already near zero

Sysdig coined the term LLMjacking in May 2024 to describe attacks where stolen AI API keys are used to run LLM inference at the victim’s expense. Langflow environments routinely hold OpenAI, Anthropic, DeepSeek, and Gemini API keys. If a JadePuffer-equivalent agent runs on credentials sourced from the compromised host itself, the compute cost to the attacker drops to zero.

Clark’s summary to CyberScoop: “The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero.”