First AI Agent Conducts Ransomware Attack

Sysdig documented JadePuffer, the first ransomware operation driven entirely by an LLM agent. It exploited CVE-2025-3248 in Langflow to gain access, then autonomously stole credentials, moved laterally, and encrypted 1,342 Nacos configuration items using MySQL's AES_ENCRYPT function. The agent adapted in real time, retrying failed steps within 31 seconds.