AI agent executes first fully autonomous ransomware attack, lowering barrier for cybercriminals

AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack

Security firm Sysdig says it has found what it believes is the first ransomware attack run from start to finish by an AI agent. Its Threat Research Team calls the operator JADEPUFFER and says a large language model handled the whole job: breaking in, stealing credentials, moving deeper into the network, then encrypting and wiping a company's production database. Ransomware has always needed a skilled person somewhere in the loop, either at the keyboard or writing the script the malware follows. If a model can chain those steps on its own, the skill needed to run an attack drops to whatever it costs to rent an AI agent. The way in was an old, already-patched bug. JADEPUFFER exploited CVE-2025-3248, a missing-authentication flaw in Langflow, an open-source tool for building AI apps and agent workflows. The flaw lets anyone who can reach the server run their own Python code on it, no login needed. Langflow boxes are a tempting target because they often sit exposed on the internet and hold API keys and cloud credentials for the services they connect to. The flaw was fixed in Langflow 1.3.0 and added to CISA's Known Exploited Vulnerabilities list in May 2025, but plenty of servers were never updated. It is not even the only Langflow bug being hit this way. Once inside, the agent worked fast and cleaned up after itself. It mapped the machine, then swept it for secrets: API keys for AI services (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials (Chinese providers like Alibaba and Tencent alongside AWS, Google, and Azure), crypto wallet keys, and database logins. It raided a MinIO storage server using its factory-default login (minioadmin:minioadmin), which had never been changed. It also set up a way back in, adding a scheduled task that pinged the attacker's server every 30 minutes. Then it pivoted to its real target: a separate, internet-facing server running a MySQL database and Alibaba's Nacos, a settings and service directory common in microservice setups. The agent logged into the database as root. Sysdig says it never saw where those root credentials came from, so their origin is unknown. From there, it took over Nacos using a 2021 authentication bypass (CVE-2021-29441) and a default signing key that Nacos has shipped unchanged since 2020, then planted its own admin account. The Ransom Note With No Key The agent encrypted all 1,342 Nacos settings, dropped the original tables, and left a ransom note demanding Bitcoin with a Proton Mail contact. It generated a random encryption key, printed it to the screen once, and never saved or sent it anywhere. There is no key to hand over. The victim cannot get the data back even if they pay. (The note claims AES-256; Sysdig notes the tool it used defaults to weaker AES-128, though the result is the same.) It then went further, deleting whole databases and leaving a comment in its own code claiming it had already copied the data somewhere else. Sysdig says that is the agent talking, not something the team could confirm, and found no evidence that any data was actually left. How Experts Know an AI Was Driving The clearest sign was the code itself. The attack payloads were full of plain-English notes explaining why each step was being taken, the running commentary a human hacker never bothers to write, but a model produces by default. The agent also fixed its own mistakes at machine speed. In one case, it went from a failed login to a correct, multi-step fix in 31 seconds, diagnosing the exact cause instead of blindly retrying. Sysdig counted more than 600 separate, purposeful payloads across the operation. One detail is still a puzzle. The Bitcoin address in the ransom note is the exact sample address that appears throughout Bitcoin's own developer documentation, which means it shows up all over the text these models are trained on. It is also a real, active wallet with a long history of payments. Sysdig cannot tell whether the model simply pasted a familiar-looking address from memory, or whether the operator deliberately used a real wallet that happens to match the famous example. Part of a Bigger Shift JADEPUFFER is the latest step in a fast-moving year for AI-driven attacks. In August 2025, researchers at ESET flagged PromptLock, billed as the first AI-powered ransomware; it later turned out to be a lab prototype from NYU called Ransomware 3.0, not a real attack. Around the same time, Anthropic reported a real extortion campaign that used its Claude Code tool to hit at least 17 organizations, with demands topping $500,000, though a human still steered that one. In November 2025, Anthropic disclosed what it called the first largely autonomous cyberattack, a Chinese state-linked spying effort that had Claude write exploits and steal data with little human help. That operation also had the AI inventing credentials that did not exist, possibly the same kind of hallucination behind JADEPUFFER's odd Bitcoin address. The pieces of a serious attack are getting automated, and old, unpatched software is the easy first target. Agents make spraying the entire back catalogue of known bugs nearly free, so neglected servers get more exposed, not less. What Defenders Should Do The fixes are familiar. Patch Langflow and never expose its code-running endpoints to the internet. Do not run AI tools with cloud keys and provider credentials sitting in their environment; keep secrets in a proper manager, away from anything the web can reach. Harden Nacos: change the default signing key, keep it off the public internet, and never let it connect to its database as root. Never expose a database's admin account to the internet, and lock down outbound traffic so a hacked server cannot phone home. Because attackers can now weaponize a fresh advisory in hours, Sysdig argues that watching for bad behavior at runtime matters more than racing to patch. Sysdig's published indicators for this operation include: * Entry point: CVE-2025-3248 (Langflow unauthenticated remote code execution) * Command-and-control: 45.131.66[.]106, with a beacon to hxxp://45.131.66[.]106:4444/beacon every 30 minutes * Claimed staging server: 64.20.53[.]230 * Ransom Bitcoin address: 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy; contact e78393397[@]proton[.]me; ransom table named README_RANSOM Sysdig calls JADEPUFFER a warning sign rather than a crisis. None of the individual moves was clever or new. What is new is that a model stitched them into a complete attack against a neglected server, on its own. Expect more of the same as agent tools mature, and treat any exposed server, config store, or database admin login as something a machine will probe, not just a person.

AI-Generated Browser Ransomware Abuses Chromium API on Windows and Android

Cybersecurity researchers have flagged a new malware artifact generated using DeepSeek that constructed a novel attack path combining "unrealistic browser-malware concepts with a real browser capability" to turn it into a working ransomware technique that runs entirely inside the browser on both Windows and Android devices. "This is the first documented case where a frontier AI model independently bridged the gap between a theoretical browser-only ransomware risk and a practical, working attack chain - surfacing a novel attack path that defenders had previously dismissed as unfeasible due to browser sandboxing limits," Check Point said in a statement shared with The Hacker News. "The expertise needed to discover a new attack path is no longer the bottleneck, and defenders need to account for that shift now -- before threat actors operationalize it at scale." The identified sample is a Python Flask application named "deepseek_python_20260125_da0631.py" that was uploaded to VirusTotal on January 25, 2026, with the Google-owned malware scanning service describing it as a "fully functional information stealer and ransomware toolkit." It has been named InfernoGrabber v9.0 by the malware author. The application is designed to operate as a malicious web server that lures victims with a fake Discord avatar AI upscaler, while stealthily running a wide array of harmful actions, including stealing Discord tokens, harvesting credit card numbers and cryptocurrency seed phrases, logging keystrokes, and capturing unauthorized webcam and microphone feeds. "The code includes specific routines for browser exploitation (targeting CVEs like CVE-2023-4863), data exfiltration via a hard-coded Discord webhook, a ransomware 'WinLocker' screen demanding Bitcoin, and an administrative dashboard for the attacker to manage stolen data," according to VirusTotal. The findings come as artificial intelligence and large language models (LLMs) are redefining the cyber threat landscape, enabling threat actors to abuse the technology to develop malware and exploits. The use of DeepSeek is noteworthy as it signals that the Chinese company's models have lower refusal rates for malicious cyber requests when compared to its Western counterparts from Anthropic, Google, or OpenAI. Other factors that may have facilitated the use of DeepSeek is its free access via the web interface, availability in regions where other frontier models do not operate, and its ability to generate a working malicious application from a "single broad prompt" as opposed to models from Anthropic or OpenAI. "DeepSeek models can turn high‑level malicious ideas into concrete, complete attacks with less expertise than competing platforms," Check Point Research said. The Israeli cybersecurity company said it unearthed the Python artifact as part of its analysis of about 3,000 files attributed to DeepSeek over the past year. Of these, 1,383 samples have been classified as malicious or dangerous. The Python malware is an instance of what's called In-Browser Ransomware that implements a browser-native technique not encountered in real-world campaigns in the past. The exact prompt that was used to produce the sample is unknown. The attack technique entails using a phishing decoy to trick a user into granting file system access to a web page, which then enumerates local files in the selected folder, reads and exfiltrates their contents, encrypts and overwrites them, and finally displays an extortion note to the victim. What makes this more unusual is that all of this can be accomplished without installing a native payload, exploiting a browser vulnerability, or requiring root access. It's worth mentioning here that the approach is limited to web browsers that expose the picker-based File System Access API. This includes Google Chrome and other Chromium-based browsers across Windows and Android operating systems. There is no evidence that the browser-native ransomware pattern has been abused in the wild. Another troubling aspect of AI-assisted development is that it not only lowers the barrier for bad actors to generate offensive code, but also the fact that they do not even need to know such a file system access API exists in the first place, or have the technical expertise to abuse it. Put differently, entering an overly broad prompt is enough for an LLM - subject to guardrails, or lack thereof -- to formulate a working attack blueprint from an abstract malicious request. When a user with limited technical understanding outlines unrealistic requirements, the model, in its quest to satisfy them, can generate hallucinated outcomes, surfacing unusual techniques in the process. "What we are witnessing is a fundamental shift in how novel cyber attacks are born. For the first time, we have evidence that an AI model can independently reason across legitimate platform features and surface a working attack technique that humans had only theorised about - without the attacker ever knowing the underlying API existed," Eli Smadja, head of research at Check Point Research, said in a statement. "The barrier to operationalizing complex attacks is collapsing, and that has profound implications for every organisation embedding AI into its workflows, and for every mobile user who now carries their entire personal and professional life inside a photo library. The future of AI security cannot rest on hoping models refuse the obvious malicious request; it must assume that the next attack technique will be discovered not by a human researcher, but by an AI hallucination that accidentally got one thing right." Smadja is also urging organizations to prepare by hardening the delivery layer, rethinking permission-based trust, and treating every browser prompt as a security decision.

When AI Invents the Attack: Browser-Native Ransomware

Check Point Research recently uncovered something that changes how we think about AI-assisted threats: a malware sample in which an AI model independently connected a theoretical browser risk to a working ransomware technique, with no exploit, no app installation, and no technical expertise required from the attacker. A Noisy Sample With One Dangerous Idea While analyzing nearly 3,000 DeepSeek-attributed files from public telemetry, our researchers came across a Python Flask application that looked, at first, like a textbook AI hallucination. It tried to pack a keylogger, credential stealer, webcam capture, and ransomware overlay into a single web page -- most of which browsers simply won't allow. The model got almost everything wrong. But buried in the noise was one thing it got exactly right. The generated code called showDirectoryPicker(), a legitimate browser API that lets a web page request access to a folder on the user's device, read files inside it, modify them, and send their contents to a remote server. No installation. No exploit. Just a permission prompt. The person who prompted it likely had no idea this API existed. They described a high-level malicious outcome, and the model searched its knowledge of real browser features to find something that fit. That process -- an AI reasoning across existing platform knowledge to surface a novel attack path -- is precisely what makes this finding significant. Why DeepSeek Is Part of This Story Major AI vendors have made cyber safety a core control area. Requests involving ransomware behavior, credential theft, or malware deployment are consistently refused by frontier models from Anthropic and OpenAI. DeepSeek is less consistent. It is free, widely accessible, and in our testing, a single broad prompt produced a complete malicious application that would have required manual assembly across multiple requests using other models. That lower barrier makes it particularly attractive to threat actors with limited technical skill. The Android Risk Is Real To validate the technique, we built a controlled proof of concept: a fake AI photo-enhancement tool that uses the File System Access API to encrypt images in a selected directory. The workflow is disarmingly natural. A user selects a photo, is asked to choose a folder for the enhanced results, approves a browser prompt that feels routine in context, and during the fake processing step, their images are encrypted. No binary is downloaded. No app is installed. The attack runs entirely inside the browser. On Android, this is especially concerning. Chrome 132 introduced full File System Access support on Android, and our testing on Chrome 148 confirmed that web pages can request access to the DCIM photo directory. This folder typically holds years of personal photos, scanned documents, banking screenshots, and recovery codes, which if lost, or even having such vital data exfiltrated, could possibly create personal or business issues, ranging from ransomware to blackmail or if the data is sensitive, public disclosure, leading to reputational damage and more. On iOS, Safari does not expose the same API, so the technique does not apply there. What You Can Do Browser folder-access prompts deserve real scrutiny. Before clicking Allow, consider which site is asking, which folder is being selected, and whether write access is actually necessary for what you came to do. Avoid granting websites access to your main photo library or any directory with sensitive or irreplaceable files. For unfamiliar tools, select an empty folder instead, and keep regular backups so that encrypted files are never your only copy. For stronger protection against the phishing-style pages that deliver attacks like this one, Check Point's Threat Cloud Anti-Phishing identifies and blocks malicious sites before users ever encounter a suspicious permission prompt. Because the entire attack depends on luring a user to a convincing fake page, disrupting that delivery step is the most effective defense available today. The Broader Shift At the time of publication, we have found no evidence this technique is being used in active campaigns. We are publishing now because the barrier to operationalizing it is low. What this research illustrates is a meaningful shift in how novel attacks emerge. Historically, discovering a new attack path required domain expertise and creative human thinking. AI changes that. A non-expert can describe a malicious outcome in plain language and receive a prototype that connects that goal to a real platform capability they never knew existed. The expertise required to discover the attack path is no longer the bottleneck -- and defenders need to account for that.