Last week, security firm Sysdig documented what it called the first known case of "agentic ransomware." An AI agent, not a human, broke into a vulnerable server, stole credentials, moved through the network, encrypted files, and wrote its own ransom note, adapting to obstacles the way a human hacker would. Coverage described the operation, dubbed JADEPUFFER, as running "without any human oversight," with "no human at the keyboard."

That's true for one part of the attack, and not the part that matters most for deciding how worried to be.

What Sysdig's own researcher actually said

In a follow-up interview, Sysdig's senior director of threat research, Michael Clark, clarified that a human was still very much involved in JADEPUFFER, just not in the technical execution. Someone chose the target. Someone launched the operation. What ran without supervision was everything after that: Roughly 600 commands, a self-correcting password-hash routine, and a real-time fix to its own parsing errors, executed by the agent alone once it was turned loose.

That's a genuinely new capability. It is also a meaningfully smaller claim than "fully autonomous," and the distance between the two is where the headlines landed.

~600
Commands the agent executed unsupervised, once launched by a human
0
AI models Sysdig could identify as the one actually driving the agent
2025
Year the exploited vulnerability was patched and added to CISA's known-exploited list

The entry point wasn't a new AI exploit. It was an old, patched bug.

JADEPUFFER got in through CVE-2025-3248, a missing-authentication flaw in Langflow, an open-source framework for building AI agent workflows. The bug lets anyone who can reach a Langflow server run their own code on it, no login required. The vendor patched it in Langflow 1.3.0, and CISA added it to its Known Exploited Vulnerabilities list in May 2025. The servers JADEPUFFER hit were simply never updated. The sophisticated part of this story is the agent's behavior after it got in. The part that let it in was ordinary, well-documented, and preventable infosec hygiene.

Also worth knowing: Sysdig says it was not able to identify the specific AI model driving JADEPUFFER, and has no visibility into its system prompt or configuration. One outside researcher, Microsoft's Geoff McDonald, has theorized the attacker used an open-weight model with its safety training stripped out rather than a frontier model, based on his own red-teaming experience showing frontier labs' safety layers holding up well against this kind of misuse. Sysdig's own account neither confirms nor rules that out. Which means the single most consequential fact for judging how alarmed to be, whose AI this actually was, is the one piece of this story nobody can currently verify.

This isn't even the first time this pattern has played out

In August 2025, security firm ESET described what it called the first AI-powered ransomware, a sample named PromptLock. It later turned out to be a research prototype built by NYU engineers, not a real attack. That same month, Anthropic disclosed that Claude Code had been used in a real extortion campaign against at least 17 organizations, with a human operator steering the campaign and the AI executing tasks under instruction. In November 2025, Anthropic went further, disclosing a largely autonomous Chinese state-linked espionage operation in which Claude wrote exploit code with minimal human direction. Three incidents, three different, more precise descriptions of what the AI actually did on its own. JADEPUFFER is a real, meaningful escalation in what runs unsupervised once launched. It is not the first AI-ransomware story to get compressed into a scarier headline than the underlying research supports.

The bottom line

The bottom line: An AI agent that can run a full ransomware operation without supervision once launched is a real, different threat than one that can also pick its own targets. That's the version of this risk that exists today, and it's serious enough on its own without inflating it into the version some early coverage implied. For any business running Langflow or similar agent-orchestration tools internally, the immediate, unglamorous action item is the same one it would have been in May 2025: Check whether it's patched.

Put This Into Practice

Reading past the scariest version of an AI security headline is step one. Auditing your own agent-orchestration tooling for known, patched vulnerabilities is the work. Every WorkplaceAI guide is written with that gap in mind.

Browse All Guides → Unvarnished Reviews →

Source: AI Pulse · Where This Breaks · workplaceai.ai. Built from Sysdig Threat Research Team's July 1, 2026 report, TechCrunch and CyberScoop's July 6 follow-up reporting including Michael Clark's on-record clarification, and Let's Data Science's comparative timeline of prior AI-ransomware incidents (ESET/PromptLock, Anthropic's August and November 2025 disclosures). Geoff McDonald's alternative-model theory is reported as his own stated theory, not confirmed fact. A fast-moving security story; verify current patch status directly rather than relying on any date referenced here.