Ransomware groups have spent a decade removing the need for skill. Ransomware-as-a-service put attack kits in the hands of anyone willing to split the ransom. Now a new layer is being removed: the need for a person at the keyboard at all.
In June 2026, researchers at Sysdig documented what they believe is the first ransomware campaign run almost entirely by an AI agent, from first foothold to ransom note. They named it JadePuffer. It is the clearest evidence yet that the question is no longer whether AI agents can automate ransomware attacks. It’s how fast defenders can catch up.
The problem the industry already had
Ransomware didn’t need AI to become an industrial-scale business. According to Akamai’s Ransomware Report, the ransomware-as-a-service (RaaS) model already runs like a legitimate supply chain, with developers who build the malware, affiliates who run the attacks on a profit-sharing split as generous as 90/10, and initial access brokers who sell network footholds for as little as $3,000. Extortion tactics have escalated in step: from single extortion, to double (encrypt and leak), to triple (add DDoS pressure), to quadruple, where attackers now contact a victim’s own customers and partners to force payment.
Most organizations have handled this the same way for years: back up the data, segment the network, hope the attacker’s affiliate program is having a slow month. That was already a losing bet. It puts the average ransomware recovery cost at $2.73 million and average downtime at 21 days, and Cybersecurity Ventures projects a combined 43,200 ransomware attacks a day worldwide by 2031.
AI doesn’t create this problem. It removes the last human bottleneck from it.
What changed: an AI agent ran the ransomware attack, not just the malware
The direction of travel was already visible before JadePuffer. The RaaS group FunkSec reportedly uses generative AI to write ransomware code, generate new variants, and run negotiation chatbots with victims, largely because the group lacks deep technical expertise of its own. Other threat actors use AI to draft convincing phishing emails and run voice-phishing calls that impersonate real staff, and commodity tools like WormGPT, DarkGPT, and FraudGPT exist specifically to strip away the skill requirement for that kind of social engineering. Even state-linked groups such as Forest Blizzard (Fancy Bear) and Emerald Sleet have reportedly used large language models to mimic official documents and speed up vulnerability research.
JadePuffer is a step past all of that. Instead of using AI to write a script or a phishing email, the attacker pointed an autonomous agent at a target and let it run the operation. According to The Hacker News, BleepingComputer, and CyberScoop, the campaign combined two known flaws to get in: an unauthenticated remote-code-execution bug in Langflow, an open-source framework for building LLM applications (CVE-2025-3248), and an authentication bypass in Nacos (CVE-2021-29441). The Langflow bug had been patched since April 2025 and sat on CISA’s Known Exploited Vulnerabilities list, but internet-facing instances were still exposed.
From there, the agent didn’t just execute a script, it reasoned through the operation in natural language, narrating its own targeting decisions the whole way: reconnaissance, credential theft, lateral movement, persistence, privilege escalation, and encryption. CyberScoop’s reporting is careful to note the agent didn’t complete every single step unaided, but it compressed what would normally take a skilled operator hours into minutes. When something failed, it adjusted without waiting for a human: in one documented instance, a failed login attempt was corrected and retried successfully in about 31 seconds.
The most telling detail, though, isn’t the speed. It’s that the “ransom” in JadePuffer may not have been recoverable even if the victim had paid. Sysdig found the encryption key was generated from what was effectively random data, printed to the terminal, but never saved or transmitted anywhere the attacker could retrieve it later. The agent also invented a Bitcoin wallet address that didn’t exist. Put together, JadePuffer didn’t run a functioning extortion scheme, it destroyed data and left a ransom note behind it. That’s arguably more useful for defenders to understand than the automation itself: an AI agent chaining ransomware TTPs together doesn’t guarantee it built anything resembling a working attacker business model.
JadePuffer isn’t an isolated data point. It follows Anthropic’s own disclosure, in August 2025, of an extortion campaign that used its Claude Code tool to hit at least 17 organizations, and a November 2025 disclosure of what the company called a largely autonomous cyberattack carried out by a state-linked group with minimal human steering. Security researchers at Trend Micro had already called 2026 “the year of AI-aided ransomware.” JadePuffer is the moment that stopped being a prediction.
If you want the fuller picture of how AI is reshaping the attack surface, not just ransomware, this is worth the next five minutes:
Why this matters even if you’re not the target of the next ransomware attack
Three things about agentic ransomware should worry defenders more than the headline itself:
- The skill floor keeps dropping. RaaS already meant an attacker didn’t need to write ransomware. Agentic AI means they increasingly don’t need to run the attack either. Renting an agent is cheaper and faster than recruiting a skilled affiliate.
- The entry point is your own AI stack. JadePuffer didn’t break in through a phishing email. It broke in through an unpatched AI application framework, the exact kind of tooling that development and data teams are standing up quickly, often outside the visibility of security teams.
- The attack moves at machine speed. An agent that fixes its own failed login in 31 seconds isn’t waiting for a human affiliate to wake up and try again tomorrow. Detection windows that assumed a human pace no longer apply.
None of this changes the fundamentals of ransomware response. The UK’s National Cyber Security Centre is unambiguous on that point: don’t pay, because payment doesn’t guarantee your data back, doesn’t remove the infection, and makes you a more attractive repeat target. The NCSC’s core advice, offline backups, an incident response plan, and continuous monitoring, is still the foundation. What agentic AI changes is how much runway that foundation buys you, and where the first foothold is likely to come from.
Where AppSec teams should actually be looking
The practical shift for security teams isn’t “buy an AI detector.” It’s recognizing that AI agents, AI application frameworks, and AI-generated code are now part of the attack surface, not just part of the defense.
That means treating a few things as first-class risks rather than edge cases:
- The AI frameworks your own teams deploy. Langflow wasn’t the target, it was the door. Any internet-facing LLM app framework, agent orchestrator, or copilot backend needs the same patching discipline as a public API.
- What your coding agents and copilots are allowed to do unsupervised. An agent that can install a package, edit a config file, or call an MCP tool without a human checking it first is an agent that can be manipulated into doing all three for an attacker.
- Malicious packages that don’t have a signature yet. Attackers using AI to generate new ransomware variants faster also means new payloads that traditional, signature-based malware scanning simply hasn’t seen.
This is precisely the gap Xygeni’s DevAI Agent was built to close: not an IDE plugin that scans code after the fact, but an agent that sits in the developer’s environment and inspects what other agents are about to do before they do it. That includes catching malicious instructions hidden in agent rules and configuration files (including invisible Unicode that won’t show up in a pull request), intercepting package installs in real time to block malware and slopsquatted lookalikes before they land, and watching MCP tool calls for poisoning and anomalous agent behavior. Xygeni’s Malware Early Warning (MEW) detects malicious packages before a signature exists, which matters directly when the payload was generated by an AI model an hour ago. And because Xygeni’s ASPM layer applies that same intelligence to findings from third-party scanners too, security teams don’t need to rip out existing tools to close the agentic gap: they extend what they already have.
Agentic ransomware is not a future threat to plan for later. JadePuffer already happened. The organizations that stay ahead of the next one will be the ones that started treating their own AI agents and their own agentic supply chain as part of the perimeter today. See what treating your AI agents as part of the perimeter actually looks like:
FAQ
What is agentic ransomware?
Agentic ransomware is a ransomware attack where an autonomous AI agent, not a human operator, carries out most of the attack lifecycle: reconnaissance, credential theft, lateral movement, persistence, encryption, and even writing the ransom note. A human still sets the target and the objective, but the AI agent handles the operational execution and adapts to obstacles on its own.
Was JadePuffer a real attack or a research demo?
JadePuffer was a real attack, analyzed by the cloud security firm Sysdig, that hit a production database in June 2026. It’s distinct from PromptLock (also called Ransomware 3.0), an earlier AI-ransomware concept that turned out to be an academic research prototype rather than a live attack in the wild.
How did the AI agent in JadePuffer get in?
Through CVE-2025-3248, an unauthenticated remote-code-execution vulnerability in Langflow, an open-source framework for building LLM applications and agent workflows. A patch had existed since April 2025 and the flaw was on CISA’s Known Exploited Vulnerabilities list, but internet-facing Langflow instances were still running unpatched.
Does AI make ransomware attacks harder to stop?
It changes the shape of the problem more than it changes the fundamentals. AI agents compress the time between initial access and impact, since they retry failed steps and adapt without waiting on a human. That means detection and response need to work at machine speed too. The core defenses, patching internet-facing systems, limiting what agents can do unsupervised, and catching malicious packages before a signature exists, matter more, not less.
Should my organization pay a ransom if it’s hit by AI-driven ransomware?
The UK National Cyber Security Centre’s guidance applies regardless of whether AI was involved: paying doesn’t guarantee you get your data back, doesn’t remove the infection, funds further criminal activity, and makes you more likely to be targeted again. Offline backups, an incident response plan, and monitoring remain the baseline defense.
How can development and security teams defend against AI agents being used as an attack vector?
Treat AI frameworks and coding agents as part of the attack surface: patch internet-facing AI application infrastructure like any public API, restrict what copilots and agents can do without human review (installing packages, editing configs, calling MCP tools), and use malware detection that doesn’t rely on a known signature, since AI-generated ransomware variants can be new every time.
