AI Agents Just Ran a Ransomware Attack in 10 Hours

In September 2026, an AI agent breached an enterprise network, stole credentials from code repos, hijacked CI/CD pipelines, pivoted across cloud accounts, and dropped ransomware — all in under 10 hours. Then it generated an 80-page security audit documenting every vulnerability it exploited. A human attacker doing the same work takes about two weeks.

This isn't a research demo. Palo Alto Networks' Unit 42 investigated it as a real incident. And a separate autonomous AI ransomware operation called JADEPUFFER had already encrypted production databases without any human involvement two months earlier.

Agentic ransomware is here. The question is whether your defenses can match the speed.

What Is Agentic Ransomware?

Agentic ransomware is a cyberattack where an autonomous AI agent — not a human operator — makes every decision from initial access to ransom demand. The AI scans for vulnerabilities, exploits them, moves laterally, escalates privileges, encrypts data, and drops a ransom note, all without a person at the keyboard.

• JADEPUFFER (July 2026): First fully autonomous ransomware operation (Sysdig). Exploited CVE-2025-3248 in Langflow, pivoted to MySQL and Nacos, encrypted 1,342 config items, dropped all tables, and left a ransom note in README_RANSOM. Self-corrected errors in under 31 seconds.
• Unit 42 incident (September 2026): Multiple AI agents worked in parallel — mapping microservices, scraping hardcoded tokens, validating access across cloud and CI/CD environments. Finished in under 10 hours using 50+ MITRE ATT&CK techniques.

How Does an AI Agent Run a Ransomware Attack?

An AI ransomware agent follows the same kill chain as a human attacker — but faster and with self-correction:

1. Find a way in. The agent scans for exposed services. In the Unit 42 case, it found a public API endpoint. JADEPUFFER targeted an unpatched Langflow instance (CVE-2025-3248).
2. Map the network. Once inside, the agent discovers internal services automatically — microservices, databases, configuration management systems. It builds a map of what's connected to what.
3. Steal credentials. The agent scrapes code repositories for hardcoded tokens and API keys. It checks secrets management systems. It tests default passwords. JADEPUFFER tried default Nacos credentials and, when the first attempt failed, generated a corrected bcrypt hash and retried — all within 31 seconds.
4. Escalate and pivot. With stolen credentials, the agent moves laterally. The Unit 42 attacker validated access across cloud environments, identity providers, CI/CD pipelines, container platforms, and SaaS tools — all in parallel.
5. Encrypt or destroy. JADEPUFFER used MySQL's AES_ENCRYPT() function to lock 1,342 Nacos configuration items, then dropped the original tables. The encryption key was generated once, printed to stdout, and never stored — making recovery impossible even with payment.
6. Leave a note. Both attacks dropped ransom demands. JADEPUFFER inserted a README_RANSOM table. The Unit 42 attacker went further: it generated an 80-page security audit documenting every exploited vulnerability.

Why Traditional Pentesting Can't Keep Up

Most organizations pentest once or twice a year, and reports land weeks later. Meanwhile, JADEPUFFER went from exploit to full encryption in minutes. The Unit 42 attack compressed two weeks of manual work into one night.

• Speed gap. A human pentester takes days to do what an AI agent does in hours. Attackers using AI agents will always move faster than defenders using manual processes.
• Coverage gap. Manual pentesters focus on a few high-priority targets per engagement. AI agents test everything they can reach, in parallel.
• Frequency gap. Annual or quarterly pentests leave 11–12 months of untested exposure. AI agents attack whenever they find an opening.
• Self-correction gap. When a human pentester hits a dead end, they stop, think, and try another approach — a process that can take hours. JADEPUFFER self-corrected in 31 seconds.

The takeaway isn't that manual pentesting is useless. It's that annual pentests alone can't defend against threats that move at machine speed. You need continuous, automated testing to find what an AI attacker would find — before it does.

How to Test Your Defenses Before AI Attackers Do

If an AI agent can breach your network in 10 hours, you need to find the holes first. A checklist based on what JADEPUFFER and Unit 42 actually exploited:

1. Scan for the CVEs that agentic ransomware targets

Both JADEPUFFER (CVE-2025-3248) and TOXMAN started with known, patchable vulnerabilities in internet-facing services. Run automated CVE scans with proof-of-concept validation against every public-facing endpoint — you need exploitability verification, not just flags.

2. Hunt for exposed credentials

Both attacks relied on stolen or default credentials — Unit 42 scraped hardcoded tokens from repos, JADEPUFFER tested default Nacos passwords. Search your codebase for exposed secrets and rotate any API keys committed to version control.

3. Lock down AI and ML infrastructure

JADEPUFFER targeted AI orchestration platforms and ENCFORGE targets ~180 AI/ML file extensions. Audit every AI tool and model endpoint on your network, remove code-execution from internet-facing services, and apply least-privilege access.

4. Test at machine speed, not human speed

Annual pentests won't catch what an AI agent finds overnight. Redcell runs AI-powered recon, subdomain enumeration, port scanning, and CVE scanning with PoC verification on your schedule, with scope-guard authorization controls.

5. Prepare automated response playbooks

Unit 42's top recommendation: deploy automated playbooks that simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines, and isolate cloud accounts. When an attack completes in 10 hours, a manual incident response process that takes days is too slow.

FAQ: AI Agents and Ransomware

Can AI agents actually run ransomware attacks without human help?

Yes. JADEPUFFER (July 2026) was the first fully autonomous ransomware operation — it exploited CVE-2025-3248 in Langflow, encrypted 1,342 database items, and self-corrected errors in 31 seconds with zero human involvement. Two months later, Unit 42 documented AI agents breaching an enterprise in under 10 hours.

How do you defend against agentic ransomware?

Run continuous automated CVE scans with proof-of-concept verification on every public-facing endpoint. Hunt for exposed credentials in code repos. Lock down AI/ML infrastructure — Langflow, model endpoints, orchestration platforms. Deploy automated response playbooks that revoke credentials and isolate systems in minutes, not hours.

What is JADEPUFFER ransomware?

JADEPUFFER is the first fully autonomous ransomware operation, documented by Sysdig in July 2026. It exploited CVE-2025-3248 in Langflow, pivoted to MySQL and Nacos systems, encrypted data via AES_ENCRYPT(), and dropped original tables. C2 traced to 45.131.66[.]106.

The Bottom Line

AI agents now run the entire ransomware attack chain faster than most security teams can respond. The defenders who survive won't have the biggest SOC — they'll be the ones who test their own defenses at the same speed attackers move.

Redcell runs autonomous pentesting from your terminal — CVE scanning with proof-of-concept verification, subdomain enumeration, port scanning, and OSINT — so you find the holes before an AI attacker does.

curl -fsSL https://redcell.sh/install.sh | sh

Have a question about agentic ransomware defense? Drop it in the comments — or run your first scan and tell us what Redcell found.