Cyber Threats The Signs Were There: What the First Autonomous Ransomware Case Confirms An AI agent has run a ransomware intrusion on its own for the first time, from break-in to data destruction. The autonomous attacks TrendAI™ Research predicted are beginning to arrive, and defending against them shifts from blocking known indicators to detecting behavior. By: Jacob Santos Jul 24, 2026 Read time: ( words) Save to Folio Key takeaways Security researchers have documented an AI agent running a full ransomware operation on its own against a live production target, planning, adapting, and executing every step from the first exploit through data destruction. This is early real-world evidence of the shift to autonomous criminal operations that our research forecast. Agent-run attacks change what defenders can rely on. They produce disposable, per-victim indicators instead of reusable tools and infrastructure, so the defensive weight shifts from sharing and blocking indicators of compromise onto behavior and technique-based detection. The novelty is automation, not tradecraft. Every weakness the agent used was old and well understood, which concentrates exposure in organizations running internet-facing AI and automation platforms or carrying default and unrotated credentials, and shortens the time available to close those gaps. The monetization layer failed even though the intrusion succeeded. The agent did not save the encryption key it generated and used a placeholder address instead of real payment infrastructure, so the operation could not have produced a payout even if the victim had complied. Ransomware has always had a person behind it. Someone picks the target, buys or builds the access, runs the tools, and extorts the victim for a payout. However, in an intrusion documented this month by the security firm Sysdig and dubbed JADEPUFFER, no one did. By their account, a large language model (LLM) agent broke into a live production system, harvested credentials, moved deeper, encrypted a database, destroyed the originals, and left a ransom note. It was choosing and sequencing every step itself in near real time, with no human at the keyboard between the break-in and the damage. An artificial intelligence (AI) acting as the operator, not the assistant, is the shift Anthropic described in November 2025, when a state-linked group used its Claude model “not just as an advisor, but to execute the cyberattacks themselves.” JADEPUFFER is that same step but aimed at extortion instead of espionage. This is also the direction TrendAI™ Research has been tracking. Our December 2025 research on the next phase of cybercrime called the turn early, pointing out that criminal work would move from “Cybercrime-as-a-Service,” where a human assembles bought capabilities, to “Cybercrime-as-a-Sidekick,” where an agent runs the job. The report calls JADEPUFFER the first agentic ransomware. JADEPUFFER shows how far AI’s role in an intrusion has climbed, from drafting text to running the whole operation (Figure 1). Figure 1. The escalating role of AI in an intrusion, from assistant to autonomous operator download The cases that led here JADEPUFFER is the latest in a two-year progression of AI-enabled attacks. Our January 2026 “ State of Criminal AI ” update found an ecosystem that had industrialized, but still hit hard practical limits. Malware that asks an LLM to write its own code on the fly, for one, dies the moment the provider revokes the key. At the time, we described it as innovative but not yet reliable enough to displace proven methods. Several separate cases mark the road to this one, and each supplied a piece of what an autonomous ransomware operation would need: LameHug, also tracked as PROMPTSTEAL and reported in July 2025, was the first malware seen querying a live LLM to generate its own commands. It was a human-operated data-theft tool, not a ransomware kill chain. PromptLock, reported by ESET in August 2025, carried the “AI-powered ransomware” label but was an academic proof-of-concept that never ran against a real victim. Anthropic’s November 2025 disclosure showed an AI agent executing most of a real intrusion, but as state-directed espionage focused on data theft, not destruction. Another autonomous, self-correcting intrusion about seven weeks earlier reached a live victim but stopped at data exfiltration rather than destruction. JADEPUFFER is the first case where all three elements meet at once, unlike any of the earlier cases. It has a full, end-to-end, agent-driven chain; destructive, extortion-focused impact; and a real production target (Figure 2). Figure 2. The continuum of AI-enabled attacks leading to the first autonomous, destructive, real-world case download The agent as operator The clearest way to see the autonomy is to look at what the agent did without being told to. Our December research laid out a criminal agentic architecture in three layers: An agent layer that acts, an orchestration layer that plans and adapts, and a data layer that informs decisions. Here, the planning and adaptation, the orchestration layer, was the model itself, not a human operator. According to Sysdig's report, the agent gained entry through an unpatched, unauthenticated remote-code-execution flaw in an internet-facing Langflow instance, an AI workflow platform. That flaw, CVE-2025-3248 , carries a Common Vulnerability Scoring System (CVSS) score of 9.8, was fixed in Langflow 1.3.0, and was added to CISA’s Known Exploited Vulnerabilities catalog in May 2025. From there, the agent harvested credentials (including cloud and AI-provider keys), reached a MinIO object store that was still on its default credentials, then pivoted to the Nacos configuration server and its backing production database. It escalated privileges by chaining a 2021 authentication bypass in Alibaba Nacos ( CVE-2021-29441 ) with a default signing key the target had never rotated, forging an administrator token to plant a backdoor account. It kept a foothold with a scheduled task that beaconed to its command-and-control server every 30 minutes. It then encrypted about 1,342 Nacos configuration records, deleted the original tables, and inserted a ransom note. A person could have done all of this. According to the report, no person did. One agent carried the whole sequence in a single continuous loop (Figure 3). Figure 3. How a single agent collapsed the entire attack chain into one autonomous loop download The agent issued more than 600 distinct, purposeful payloads in a compressed window. When it created the backdoor administrator account and the login failed, it diagnosed the cause (a malformed password hash), deleted the broken account, regenerated the hash correctly, reinserted the account, and confirmed access, all in about 31 seconds. When a storage service returned data in an unexpected format, it rewrote its own parser to handle the response. When an attack path reported that a custom secret was in use, it dropped that path at once. That pattern of rewriting on the fly to work around each failure isn’t a fixed script or a human working through a checklist, but is more like an operator reasoning about what it’s seeing. Our research warned that this capability , where one decision can now run from access to impact with no human action in between, would collapse the traditional attack chain. What agent-run attacks change for defenders That collapse has three consequences for defenders that matter more than any single indicator, and none is unique to this one operation. Agent-run attacks leave almost nothing to block Conventional ransomware is generous with evidence. It reuses tools, binaries, and infrastructure, which is why so much of the industry’s defense is built on sharing and blocking indicators of compromise. JADEPUFFER offered almost none of that. There were no file hashes, because the payloads were inline code, effectively unique to this victim. The command-and-control (C&C) address may already be dead. The exfiltration destination named in the code was, on the evidence, invented by the model. The ransom address was a public example copied from documentation. An agent that writes single-use code and improvises its own infrastructure leaves only disposable, per-victim indicators, shifting the defensive load from indicators onto behavior and technique. The durable signal is the behavior: An application server spawning a process that decodes and runs payloads, a scheduled task beaconing on a fixed interval, or a database process encrypting configuration tables and then dropping them (Table 1). Indicator-based defense (degrades against this attack) Behavior-based detection (carries the load) File hashes: none - payloads were inline code, unique to each victim Payload-decoding child process - an application server spawns a process that decodes and runs code C&C address: may be dead - single-use infrastructure, likely already offline Fixed-interval beacon - scheduled outbound calls from that host on a regular cadence Exfiltration IP: hallucinated - the model invented it; no data left the network Encrypt-then-drop on config tables - AES_ENCRYPT() on configuration tables, followed by DROP Ransom wallet: placeholder - a public example address, not the attacker's Disposable, per-victim Constant across the attack Table 1. Why agent-run attacks weaken indicator-based defense and shift weight onto behavior The agent narrates its own intent, and some of it is false This case produced a new kind of evidence. The agent’s payloads were full of plain-language comments explaining what it was doing and why, including a note that tagged one database as “High-ROI” before dropping it. The agent’s intent, written out in its own words, is a kind of evidence defenders have rarely had. It helps with understanding motivation and with reconstructing a timeline. The same self-narration included claims that were not true, most clearly that data had been exfiltrated to an extern