Sysdig Says AI Ransomware Still Needed Human Setup

JadePuffer was the first known ransomware operation in which an AI agent handled the technical execution of a real-world cyberattack from start to finish, but the attack still required a human to choose the victim, prepare its infrastructure and supply database credentials.

TechCrunch reported the clarification after Sysdig researchers initially described the operation as agentic ransomware that ran “without any human oversight.”

Michael Clark, Sysdig’s senior director of threat research, told CyberScoop that a person set up the command-and-control server, the staging server for stolen data and the victim selection.

The credentials used to enter the victim’s database were obtained separately through a prior compromise and handed to the operation.

Once those conditions were in place, the agent carried out the intrusion.

It entered through a known vulnerability in Langflow, an open-source tool for building LLM applications, then moved to a production MySQL server and exploited another known flaw to gain administrator access.

The agent encrypted more than 1,300 configuration records, wrote its own ransom note and left a Bitcoin address for payment.

Sysdig has not disclosed the victim.

The techniques were ordinary known exploits rather than novel attack methods.

What distinguished the operation was the agent’s speed and ability to adapt.

It repaired a failed login in 31 seconds while narrating its reasoning in natural-language code comments.

Stolen keys did not identify the model

Clark also clarified which models were involved.

He had told CyberScoop that Sysdig found harvested keys for OpenAI, Anthropic, DeepSeek and Gemini, leaving open the possibility that several models powered different stages of the intrusion.

Those keys were part of the stolen data, Clark later told TechCrunch by email.

The agent searched the Langflow host for provider API keys, cloud credentials, cryptocurrency wallets and database configurations.

The provider keys indicated what the attacker considered valuable, but not which model made the decisions.

Sysdig was unable to identify the specific model driving JadePuffer.

Clark said the company also had no visibility into the agent’s system prompt or configuration.

Scale remains tied to human preparation

Microsoft researcher Geoff McDonald suggested on LinkedIn that an open-weight model with its safety training stripped out may have powered the attack.

He based that view on red-teaming experience indicating that frontier labs’ safety layers hold up well.

Sysdig’s account neither confirms nor rules out the theory.

McDonald also warned that ransomware campaigns could become constrained mainly by attacker budgets rather than human effort, potentially enabling “thousands or tens of thousands of simultaneous campaigns.” The JadePuffer operation still had a human bottleneck: someone had to select each victim, provision the infrastructure and obtain database credentials.

Sysdig has not seen the same operation hit other victims yet.

Clark said the low cost of running an agent could change that.