JadePuffer shows a new phase in AI-driven ransomware

Security researchers have identified JadePuffer as the first known agentic ransomware fully governed by a large language model. The system is notable because it goes beyond the classic model of ransomware, in which attackers still need to steer the operation remotely. Instead, JadePuffer can discover targets, collect credentials, move through a system, and encrypt files on its own, while adapting to conditions in real time. The reported entry point was a zero-day flaw in Langflow, an open-source AI development tool. From there, the malware expanded its reach by accessing a Nacos server and a MySQL database. Researchers also said the AI agent recovered from a failed backdoor attempt in just 31 seconds by analyzing the failure and switching methods. The finding suggests that AI-enabled, self-directed cyberattacks are moving from theory into real use, and that defenses based only on signatures may not be enough.