AI Ransomware Attack Still Required Human Setup, Sysdig Clarifies

Security researchers made headlines last week when they claimed to have found the first agentic ransomware attack—an operation dubbed JadePuffer in which an AI system autonomously executed a real cyberattack from beginning to end. The agent infiltrated a vulnerable system, extracted login credentials, traversed the network, locked up files, and even composed its own ransom demand. Early coverage portrayed this as happening "without any human oversight."

But that framing glosses over crucial human involvement, according to Sysdig's Michael Clark, the firm's senior director of threat research. While humans didn't handle the technical exploitation, they remained essential operators behind the scenes.

What the AI Actually Did—and Didn't#

The technical side of the attack was indeed striking. The agent leveraged a known vulnerability in Langflow, an open-source platform for building large language model applications, to gain entry. From there, it compromised a MySQL production server and leveraged a separate flaw to elevate privileges. Over 1,300 configuration records were encrypted, and the agent left behind a self-written ransom note with a Bitcoin address for payment. The entire login fix happened in 31 seconds, complete with natural-language reasoning in code comments.

However, the AI did not independently acquire the initial credentials. According to Clark, those were obtained through an earlier breach and handed to the operation—a significant gap that fundamentally changes the attack's profile.

The Human Infrastructure Behind the Machine#

Beyond credential supply, people were needed to:

• Set up and target the operation, selecting which organization to attack
• Provision backend systems, including command-and-control servers and staging areas for stolen data
• Manage the overall operation and direct its focus

Clark stressed that none of this contradicts Sysdig's original findings about the agent's autonomous technical performance—only the narrative that surrounded it.

Unresolved Questions About the Model#

Initial reporting suggested multiple AI models powered different attack stages, after Sysdig researchers found harvested API keys for OpenAI, Anthropic, DeepSeek, and Gemini. Clark later clarified that these keys were simply stolen goods, not evidence of multiple models driving the intrusion. The agent collected them along with cloud credentials and cryptocurrency wallets.