In late June, security firm Sysdig documented something new: a ransomware attack where an AI agent, not a human at a keyboard, carried out nearly the entire operation. Dubbed JADEPUFFER, the agent broke into a server, looked around, stole credentials, spread, encrypted data, and even wrote the ransom note, firing off more than 600 distinct actions and, at one point, fixing its own failed step in 31 seconds. It is a genuine milestone, and it is worth understanding calmly rather than in a panic, because the honest details point to some very ordinary lessons.
What actually happened
Sysdig's researchers watched an AI agent work through the full ransomware playbook: reconnaissance, credential theft, lateral movement across the network, persistence, encryption, destruction, and the ransom demand. It got in by exploiting a known flaw (CVE-2025-3248) in an internet-facing instance of Langflow, a tool for building AI workflows, and landed on a production server. Along the way it hunted for and grabbed API keys for several AI services. The striking part was the speed and adaptability: when one step failed, the agent diagnosed the problem and redeployed a corrected version in half a minute, the kind of tireless iteration a human operator cannot match.
The part the headlines skip
Here is the honest caveat, and it matters. JADEPUFFER was not a fully autonomous AI deciding to rob a company on its own. A human still set the whole thing up: they provisioned the infrastructure, stood up the command-and-control and data-staging servers, and chose the victim. The root credentials the agent used were not even stolen during the attack, they came from a person's earlier break-in. So what actually got automated was the execution, the hands-on-keyboard tactical work in the middle. The strategy, targeting, and setup were still human.
That distinction is the whole story for a small business. This is not "AI has gone rogue." It is "the labour-intensive middle of an attack just got faster, cheaper, and more scalable." An attacker who once needed hours of skilled effort per target can now let an agent grind through it, which means more attacks, against more small targets, more often.
Why this matters for a small business
The uncomfortable news is that automation makes small, "not worth the effort" targets suddenly worth it, because the effort dropped. The reassuring news is that JADEPUFFER did not use any new magic. It walked through the front door of an unpatched, internet-facing application, then relied on weak internal controls to move around. Every step it took is a step the usual fundamentals still stop:
- Patch and reduce your internet-facing surface. The whole attack started with one exposed, out-of-date app. Know what of yours is reachable from the internet, keep it patched, and take offline anything that does not need to be public. Our vulnerability management guide is the how-to.
- Least privilege. The agent spread because it could. Limiting what any one account or server can reach turns a full compromise back into a contained one.
- Tested, offline backups. An attack that destroys and encrypts data is survivable if you can restore. An untested backup is not a backup.
- Watch for the noise. Six hundred rapid actions is not subtle. Monitoring that flags unusual activity is how a fast attack gets caught before it finishes.