#118 - Agentic Ransomware: First Autonomous AI Attack Chain Confirmed

PRESENTED BY

Cyber AI Chronicle

By Simon Ganiere · 5^th July 2026

Welcome back!

Last week the agent narrated it out loud. Sysdig captured the payload logs from a ransomware operation called JadePuffer, and inside them is the LLM talking through its own targeting decisions, in real time, while it harvests credentials and moves laterally through a production database. Sysdig calls it the first fully autonomous, end-to-end ransomware attack. That claim is doing a lot of work, and it deserves scrutiny before it goes on a board slide.

Here is the honest version. What is confirmed: a real, unauthenticated RCE in Langflow was weaponised, real credentials were harvested, real data was encrypted, and it happened without a human clicking anything between steps. What is not confirmed: whether the "autonomy" was an LLM making open-ended decisions, or a conventional retry-and-replan orchestration loop with an LLM narrating its own outputs. Both produce identical logs. Sysdig's own instrumentation cannot tell them apart, and neither can I from a news write-up.

That distinction matters less than the operational fact underneath it. Whether the decision-maker was a model or a script wrapped around one, the attack ran end-to-end with no human in the loop, and it ran against infrastructure organisations left exposed. The skill floor for this class of ransomware just dropped, regardless of how much genuine reasoning was inside the loop.

🤖🏃 AI Autonomous & Agentic Attacks: ↑↑↑ 200%

🛡️ AI System Vulnerabilities: ↑↑↑ 300%

🔗 AI Supply Chain & Developer Tool Abuse: ↑↑ 150%

🔍 AI-Accelerated Vulnerability Exploitation: ↑↑ 200%

📜 AI Governance & Defense: ↑↑↑ 750%

🤖 AI-Enabled Social Engineering: ↓ 50%

SPONSORED BY

Most SaaS finance teams know their billing process is slow.Most SaaS finance teams know their billing process is slow. Few know what it's costing them.

The Tabs Billing Lag Calculator puts a dollar figure on it in two minutes — benchmarked against top SaaS companies.

See your number.

1. JadePuffer: the ransomware that ran itself, probably

Sysdig's writeup of JadePuffer describes an LLM agent exploiting CVE-2025-3248, an unauthenticated RCE in the open-source Langflow AI workflow platform, then autonomously harvesting cloud and database credentials, escalating privileges via a second Nacos vulnerability, and encrypting 1,342 configuration items before dropping a ransom note as a database table rather than a file. No decryption key was retained, so paying doesn't help. Sysdig frames this as the first confirmed end-to-end agentic ransomware attack.

Overwatch's own case tracking rates that framing at medium confidence, for a specific reason: retry-and-replan orchestration frameworks like LangGraph or CrewAI can reproduce the exact "recovers from failure within seconds" behaviour Sysdig cites as evidence of autonomy, with zero open-ended reasoning involved. A scripted state machine and a genuinely autonomous agent look identical in a payload log. Nobody outside Sysdig's own telemetry can currently tell them apart, and Sysdig's instrumentation wasn't built to answer that question.

Here's what doesn't depend on resolving that debate. A known, unauthenticated RCE sat exposed in production infrastructure long enough to be found and fully weaponised without a human operator, and it recovered from its own mistakes fast enough to matter. Whether that recovery came from a model or a for-loop, your Langflow, Flowise, or n8n instance doesn't care. If you're running exposed AI orchestration tooling, this is the week to check patch status and add database-layer ransom note detection, not filesystem-only monitoring, to your playbook.

2. GuardFall confirms the coding-agent problem is structural, not Amazon's

Last week this edition covered two Amazon Q Developer CVEs that let a malicious repository trigger command execution and steal a developer's cloud credentials. Adversa AI's GuardFall research, published days later, shows the same failure mode across 10 of 11 tested open-source AI coding agents, including Goose, Cline, Aider, OpenHands, and Plandex. The technique is not new. Bash text-normalisation tricks like quote removal and $IFS spacing have defeated plain-text command blocklists for decades. What's new is that AI coding agents inherited the blocklist approach wholesale, and only one tested agent, Continue, implemented the tokenize-and-canonicalize parsing that actually closes the gap.

Overwatch's active case on this exact pattern (opened after a separate Claude Code exploitation cluster in late June) now rates the ecosystem-wide exposure at medium confidence and flags something worth sitting with: neither GuardFall writeup mentions whether Claude Code itself was tested. That silence is not evidence of immunity. It's an evidentiary gap, and the case explicitly treats it as one pending resolution.

There is no CVE to patch here, because there's no single vulnerable product. The fix is architectural: stop trusting pattern-based command filtering in any coding agent running with auto-execute enabled, especially in CI/CD. Ask your vendor whether their agent tokenizes commands before evaluating them, or just matches strings. If they don't know what you're asking, that's your answer.

3. BioShocking: convince the AI browser it's playing a game, then take its cookies

LayerX researchers disclosed a prompt injection technique called BioShocking that works by embedding attack instructions inside a fictional game framing, telling the AI agent that incorrect actions inside this "game" carry no real consequence. Tested against six agentic AI browsers, including ChatGPT Atlas, Comet, and the Claude Chrome plugin, all six followed the injected instructions to navigate to an attacker-controlled page and exfiltrate credentials from an authenticated session. OpenAI shipped a working fix. Anthropic's patch didn't hold. Perplexity closed the report without action. Three other vendors haven't responded at all.

The root failure isn't a missing filter, it's that these agents apply game logic instead of real-world safety logic once their operational framing has been hijacked. That's a different failure mode from the credential-harvesting phishing this edition covered a fortnight ago, and it sits in the same family as the MCP tool-poisoning research Microsoft published this week showing Copilot Studio agents exfiltrating invoice data through poisoned tool descriptions. In both cases, every individual action the agent takes looks legitimate in isolation. The compromise lives in the context the agent was tricked into trusting, not in any single step an auditor could flag.

If your organisation has sanctioned agentic browsers or Copilot-style agents with access to authenticated sessions, don't wait for a vendor patch roadmap. Scope what those agents can reach, and assume any framing device, a game, a role-play, a fictional scenario embedded in a webpage, is now a viable delivery mechanism for instruction override.

🤖 AI-Enabled Social Engineering: Microsoft attributed a wave of AI-brand phishing (fake ChatGPT, Claude, DeepSeek, and Copilot lures) to initial access broker Storm-3075, with one single-day campaign reaching over 66,000 devices via AiTM credential theft and malware-signing-as-a-service.

🔗 AI Supply Chain Abuse: Unit 42 found five malicious skills sitting undetected on OpenClaw's ClawHub marketplace for three months, including an agentic front-running scheme coordinating AI agent botnets for a Solana pump-and-dump.

🛡️ AI System Vulnerabilities: Microsoft disclosed MCP tool-description poisoning against Copilot Studio, where hidden instructions in third-party tool metadata caused an agent to exfiltrate invoice data while every logged action appeared authorised.

📜 AI Governance & Defense: SecurityWeek published commentary on token-cost volatility in agentic security tooling budgets, and separately on auditing AI-generated code, citing that one in five organisations has already had a serious incident tied to it.

Langflow is the one that matters this week. It's under active exploitation, the exploit chain is now public, and every unpatched exposed instance is a plausible next JadePuffer victim. The Cursor flaws are serious but already patched with no observed abuse, so they're this week's audit item, not this week's fire drill.

Two things happened this week, and they are not the same thing. The genuinely new development is that agentic ransomware moved from research demonstration to a documented field case, against real infrastructure, with real encrypted data nobody can recover. That's a threshold crossing regardless of how much of the decision-making was open-ended reasoning versus a well-built retry loop.

The noise is the framing around it. "First fully autonomous attack" is a claim built on one vendor's telemetry, and Overwatch's own case tracking rates it at medium confidence for exactly that reason. Apply the fear instinct check here: the attack is concerning because a known RCE sat exposed and got fully weaponised end to end, not because a machine achieved some new form of agency. Don't let the second story distract the board from the first.

The connective tissue across this week's coverage is that AI tooling keeps inheriting security assumptions built for a world with a human in every loop. Coding agents inherited pattern-based blocklists. AI browsers inherited content filters that don't survive a fictional framing device. Orchestration platforms inherited default exposure. None of these are new vulnerability classes. They're old assumptions, unexamined, now running at agent speed.

On Monday, don't ask whether your AI tools are patched. Ask whether anyone has actually tried to break the trust boundary each one assumes, the blocklist, the content filter, the network exposure, rather than just checking the version number.

Reference: AI Influence Level from Daniel Miessler

Till next time!

Project Overwatch is how a CISO gets ready for what is coming. Every week, the signal across cybersecurity, AI, and resilience, filtered down to what changes your decisions, by someone who actually does this job. Not breaking news. Foresight you can act on.