An artificial intelligence system carried out a ransomware attack on its own – mostly. The attack included everything from breaking into the network to extorting the victim, without a human directing the intrusion step by step.
NCC Group researchers said it’s the first, where an end-to-end autonomous ransomware attack was spotted and confirmed in the wild. A human still chose the target and set up the infrastructure beforehand; from that point on, the agent ran the attack itself.
The agent, which researchers at cloud security firm Sysdig named JADEPUFFER, adapted and executed its initial compromise via an extortion-base intrusion, according to NCC Group’s Monthly Threat Pulse for July, published Wednesday.
Citing Sysdig’s original research, NCC Group said unlike prior AI-assisted attacks, in which human operators still directed key stages, JADEPUFFER planned and carried out the operation itself once deployed.
“During the intrusion, it corrected failed actions, identified alternative attack paths, and deleted and recreated the account with a simpler password to continue the compromise,” wrote NCC Group researchers.
Now the Twist
NCC Group said the attack wasn’t motivated by money. Instead, they said there were indicators that JADEPUFFER was built to demonstrate what technology can do, not to collect a payout.
Now that the concept is proven, NCC Group warned, criminal groups could adopt the same approach to run attacks at machine speed and scale, with future increases in ransomware volume driven less by new hacking tricks and more by the sheer number of autonomous agents doing the work.
“The development indicates that future ransomware campaigns could incorporate AI agents capable of independently making operational decisions and progressing through complex attack chains with reduced human involvement,” researchers wrote.
While Sysdig was first to published the JADEPUFFER research, NCC Group takes it a step further. It digs into how much of the attack was actually autonomous, how similar JADEPUFFER is to separate AI-orchestrated espionage campaigns, and the consequences of when automation gets paired with more capable exploit-development models.
Robot TTPs
JADEPUFFER broke in through an unpatched Langflow server, exploiting a critical code-execution flaw, CVE-2025-3248, then pivoted to a production backend running MySQL and Alibaba Nacos. From there it moved laterally on its own, using a separate authentication-bypass bug, CVE-2021-29441. When a login failed, the agent diagnosed the error, deleted the broken account and rebuilt it with simpler credentials, all within a 31-second loop and no human involved.
“Unlike other AI-assisted ransomware, where decision-making processes are hardcoded by human operators, it removed the payload-created problematic account following a failed login attempt and recreated it with a simpler password without any human intervention,” said NCC Group.
It encrypted 1,342 Nacos configurations using MySQL’s own encryption functions, then printed the decryption key to the screen instead of saving it. Neither the victim nor the attacker could unlock the files. A ransom note demanded Bitcoin payment anyway. Researchers called the botched key handling and chatty code comments signs of a proof-of-concept, not real extortion.
Seventeen days later, JADEPUFFER returned smarter, according to NCC Group. After a payload download failed, it broke out of its own container through an exposed Docker socket and deployed ENCFORGE, a custom ransomware strain built specifically to hit AI infrastructure. The second payload encrypted training data and models across 180 file types using AES-256-CTR and RSA-2048. Researchers estimate that’s damage that can cost $75,000 to $500,000 to rebuild.
Smart Enough to Break In, Dumb Enough to Lose the Key
No ransom was paid. Researchers said there was nothing left to negotiate for. JADEPUFFER’s own encryption process closed off any path back to the data, even if the victim had tried.
Nevertheless, the agent still ran the script delivering the extortion note, contact email, Bitcoin wallet, the whole routine. But the AES key it generated existed for exactly one moment. It printed once to stdout (short for standard output), then gone. Never saved, never sent to a command-and-control server, never written anywhere retrievable. Not the victim, not JADEPUFFER’s own operators, had a way to unlock the files.
Researchers pointed to that broken key-handling, plus personal reasoning comments left behind in the code.
It was a proof-of-concept that skipped the one step ransomware actually depends on, keeping the key. Even autonomous malware, it turns out, can lose their keys and lock itself out of the house.
July Ransomware Landscape
JADEPUFFER research was part of NCC Group’s Monthly Threat Pulse for July. It recorded 894 ransomware cases globally in July, a 22% jump from June and the highest monthly total so far in 2026, though still 19% below the all-time record of 1,099 attacks set in February 2025.
North America and Europe absorbed 70% of that activity, 41% and 29% respectively, and industrials remained the most targeted sector at 28%. The Gentlemen, a ransomware-as-a-service operation, claimed 15% of July’s attacks, while a newer group calling itself CRPxO listed 36 unverified victims. NCC Group noted that new entrants such as CRPxO routinely inflate their numbers to look more dangerous than they are.
Matt Hull, NCC Group’s vice president of cyber intelligence and response, said AI is “changing the speed and scale of cyberattacks” and making phishing and social-engineering content more convincing. The fundamentals, he said, still apply. Defenders need strong identity and access controls, vulnerability management, environment-wide visibility and the ability to detect and respond quickly.
Do Hackers Also Worry AI is Taking Their Jobs?
Examples of autonomous AI taking the lead on cyberattacks are multiplying. Wiz’s disclosure that an autonomous “Red Agent” breached an airline’s passenger database in 15 minutes with no credentials.
Anthropic disclosed a Chinese state group that ran Claude Code through most of a 30-target espionage campaign. That attack was mostly autonomous with humans still signed off on each strike. Google’s threat intelligence team confirmed AI finding and weaponizing a zero-day on its own. Palo Alto Networks caught an AI agent judge one target not worth the effort, then pick a better one itself.
In Taiwan, coordinated agents mapped 21 government systems and cracked 85 accounts in four days. It was the first known fully automated attack on a government.
JADEPUFFER is the first documented case of that same autonomy pointed at extortion instead of a sanctioned security test. Whether it stays a proof-of-concept or gets copied by an affiliate program is the story to watch the rest of 2026.
