TL;DR: Sysdig caught an AI agent running a full ransomware attack on its own, from a public Langflow break-in to an encrypted database, and it patched its own broken exploit in 31 seconds. Every bug it used was old and known; the operator is what's new. Below: the attack in five stages, the two tells that mark a machine, and the checks that stop each stage.
For years the hard part of an attack was the human who read the errors and adjusted. That part just got automated. Sysdig caught a real ransomware attack that an AI ran end to end: in through a public Langflow, cloud credentials off the box, a backdoor admin planted, the database encrypted, its own broken exploit patched on the way. In the same two weeks, a researcher pointed the same kind of loop at an EDR and pulled its detection rules straight out. When a model runs the attack, the tells change, and so does the logging you need to catch it.
Attack of the Week: an AI ran the whole thing
Michael Clark at Sysdig, "JADEPUFFER: Agentic ransomware for automated database extortion" [2026-07-01]
How it runs. The front door is a public Langflow instance, the AI-pipeline builder. The agent got in through CVE-2025-3248, a missing-auth RCE in its code-validation endpoint, then ran id, uname -a, hostname, then swept the host for credentials across the major AI and cloud providers: OpenAI, Anthropic, Gemini, DeepSeek, AWS, GCP, Azure, and the Chinese clouds. It found MinIO on 127.0.0.1:9000 still using minioadmin:minioadmin, pulled a credentials.json out of an internal bucket, and dropped a crontab entry that called back to 45.131.66[.]106:4444 every 30 minutes.
The database server was next: MySQL behind an Alibaba Nacos config service. The agent hit Nacos several ways at once, including the auth-bypass family (CVE-2021-29441). The agent tried to forge an admin token with Nacos's well-known default signing key, but it bounced back custom secret in use. So it took the blunt path: it wrote a backdoor admin straight into the Nacos backing database, an xadmin user with a bcrypt password hash, promoted to ROLE_ADMIN.
Then it encrypted, running 1,342 Nacos configuration items through MySQL's AES_ENCRYPT(), dropping the originals, and leaving a README_RANSOM table. The AES key was base64(uuid4().bytes + uuid4().bytes), printed to stdout and never saved. Paying gets the victim nothing. The key is gone.
Two things mark the driver as a machine. First, the decoded payloads are full of plain-English notes explaining what each step is for. One line reads "High-ROI databases to drop (data already backed up to 64.20.53[.]230)." Sysdig found no evidence anything was backed up there, so the agent was narrating its own plan, writing down the thinking a person would keep in their head.
The second tell is speed. At 19:34:36 a backdoor-admin login failed. The agent diagnosed it, tested defaults, and at 19:35:07 shipped a 15-line corrective payload that deleted the broken row, rebuilt the hash with a direct bcrypt import, and reinserted it. The login succeeded at 19:35:18. That loop, from broken login to working fix, ran in 31 seconds. Only automation moves that fast.
Every exploit in this chain was old news. CVE-2025-3248 is a 2025 Langflow bug, CVE-2021-29441 an older Nacos auth-bypass, the MinIO login the vendor default. What's new is the operator. An agent chained the known bugs, swept the credentials, and repaired its own broken step, start to finish, on its own.
Ship This Week. The exploited path is a chain of defaults, so break the chain:
Patch Langflow (
CVE-2025-3248) and get any internet-facing AI-pipeline framework (Langflow, Flowise, Dify) behind auth. That endpoint was the entire front door.Lock down who can write to your config service's backing database. The token forgery failed; the agent won by writing a backdoor admin straight into the Nacos store, so direct write access there is the control that mattered. Rotate the default signing key too, it's the first thing attackers try.
Get long-lived cloud keys off orchestration boxes. The cash-out was a credential sweep of the compromised host, so short-lived scoped sessions beat static keys sitting in the environment.
Detection: alert on a new scheduled task making a regular outbound call to a raw IP on a high port. The 30-minute callback to
45.131.66[.]106:4444is a cron phoning home, and that shape is cheap to catch.
The chain, stage by stage. Every bug was old; the operator was the machine.
Defender's Corner: pressure-test the pipeline before you trust it
Before you trust a control to catch something like this, check the pipeline it runs on. Aidan Steele, "CloudTrail in CloudWatch isn't very good" [2026-06-19] walks the failure modes of routing CloudTrail into CloudWatch, a common way to wire up alerting.
Start with turn-up time. After he switched on an org-level rule, events took about 8 hours to start flowing. AWS documents up to 24. A pipeline you switch on mid-incident is useless for the opening hours. The attacker above went from failed exploit to working fix in 31 seconds, faster than a fresh pipeline delivers its first event.
Then coverage. The org rule hits member accounts but skips the management account, so your most dangerous surface needs its own config. Events land in each account's own log group, so centralizing them means a second rule plus its service-linked roles, and you lose the tag and global-condition-key enrichment CloudTrail Lake gave you.
Do this: on your highest-value account, confirm CloudTrail events are reaching your alerting log group, and check the management account separately.
One control per stage. Each number maps to the attack diagram.
Agent Bench: hunt the footholds an agent would find first
JADEPUFFER's front door was a public Langflow, findable from the internet before the attack started. The upgrades waiting inside, a default MinIO credential and long-lived keys on the box, were sitting there for anyone who looked. An audit catches both: some from your IaC, some only from the running account.
Point a coding agent at your Terraform or CDK plus your security-group and firewall config, and have it surface four foothold classes:
Ingress from
0.0.0.0/0to anything that isn't meant to be public, especially app, admin, and database ports.Services running software with known unauthenticated RCE exposed to the internet: AI-pipeline tools, Nacos, Jenkins, object stores, message brokers.
Hardcoded default credentials or signing keys left in the config or IaC.
Internet-reachable hosts that also hold long-lived cloud credentials, the recon-to-cash-out path that made this attack pay.
For each hit, require the file:line and the exact ingress rule that makes it reachable. Two failure modes to expect. The agent will call a resource "public" off a security group alone, without checking the route table, NACL, or load balancer in front of it, so confirm real reachability yourself. And the IaC read only catches what's written down; a service still running on a vendor default, or a key sitting in a live host's environment, needs an active check against the running account, which the code alone won't show.
What you walk away with: a ranked list of internet-reachable footholds, worst-exposed first, each one tied to the file:line you then close or justify.
ASM, my external attack-surface scanner (github.com/raajheshkannaa/attack-surface-management), runs the continuous version: it enumerates every public IP across an AWS Organization and alerts on new open ports. The agent pass over your IaC catches the exposure before it's deployed.
Try it this week: run this over the one account holding your most sensitive data, and start with anything exposed by an ingress rule from 0.0.0.0/0.
Also on the Radar
Adam Chester at SpecterOps, "Accelerating EDR Evasion with LLM-Driven Analysis" [2026-06-29]. The same LLM-driven loop points at the defense too. Chester built a reverse-engineering harness, "Day Shift," that drove GPT-5.5-Cyber against Binary Ninja over MCP in a container and ran it against Palo Alto's Cortex XDR. It pulled thousands of the product's own detections out, 9,350 DSE rules, 4,209 behavioral (BIOC) rules, and 7 machine-learning models, then showed how to evade them.
Chester's own read is sober: EDR stays necessary, and it can't be your only layer. When a harness reads your EDR's rulebook this cheaply, that's a heavier case for prevention and attack-surface reduction alongside the detection you keep.
💼 Recon Roles
Staff Security Engineer (AI Platform) · Chainguard
Chainguard, the supply-chain-security company behind hardened container images, is hiring a Staff Security Engineer to secure its own AI platform, remote in both the US and Canada. Read the scope before you assume it's product security. The role sits in IT Engineering under Cyber Resiliency and owns the company's internal AI surface: administering the Claude and ChatGPT environments, governing API integrations, and building MCP servers. This is the emerging "secure the agents your own company runs" job, closer to AI-platform operations than to the CVE research Chainguard is known for. Staff-level IC, no direct reports. The US listing publishes a band of $170,000 to $231,000; the Canadian twin hides comp, so ask early if you're north of the border.
Staff Backend Engineer, Software Supply Chain Security · GitLab
GitLab's Software Supply Chain Security Add-On team is hiring a Staff Backend Engineer, open to remote candidates in India. The scope is the real supply-chain-security stack: package policy enforcement, build provenance, artifact signing, malicious-package detection, and SLSA Level 2 and 3 with Sigstore integration. It's a backend-engineering role in a security domain, so expect to build the enforcement plumbing rather than write detections. The posting hides comp entirely, odd from a company that built its name on transparency, so ask for the India band on the first call.
India remote. Verified open as of 2026-07-04. Apply: India
Roles can close anytime. No affiliation or payment. Found one already closed? Reply and tell me.
The offensive labor is what the model automated: the recon, the failed exploit retried in seconds, the reverse-engineering of your EDR. The target didn't change. An agent still needs an exposed way in and credentials within reach, so cutting both is where your effort pays off. Pick one account this week and find the foothold before the agent does.
Know someone who'd want this in their inbox? Forward it to them.
Read it online: join.defensive.works/p/an-ai-ran-the-whole-ransomware-attack