The first fully autonomous AI ransomware attack turns out to have had a human involved after all, does that change how worried you should be?

[MickFoley]

Security firm Sysdig made headlines documenting JadePuffer, described as the first ransomware operation handled end to end by an AI agent rather than a human, breaking into a server, stealing credentials, moving through the network, encrypting files and writing its own ransom note. Follow up reporting this week added an important correction, a human was still very much involved, just not in the technical execution

Sysdig's Michael Clark clarified that a person set up the operation, provisioned the infrastructure, chose the victim, and separately obtained the stolen credentials the agent then used, they were handed to the operation rather than harvested by the AI itself. None of that contradicts the technical details, which remain genuinely striking, the agent exploited a known Langflow vulnerability then a MySQL flaw, adapted in real time, and once went from a failed login to a working fix in 31 seconds

The bigger unresolved question is which model actually drove the attack. Sysdig said multiple provider API keys, OpenAI, Anthropic, DeepSeek and Gemini, were found on the compromised system, but clarified those were simply stolen loot, not evidence of what powered the agent's decisions, and the company could not identify the specific model or see its system prompt

A researcher's competing theory is that an open weight model with safety training deliberately stripped out is more likely than a frontier model, since red teaming generally shows frontier labs' safety layers holding up reasonably well against this kind of misuse

So the debate. Does the human still being involved in setup and target selection meaningfully lower how alarmed you should be about this story, or was the technical execution always the scary part regardless of who picked the target, and does not knowing which model ran it change how you think about which companies bear responsibility here?

The 'first' AI-run ransomware attack still needed a human | TechCrunchtechcrunch.com

[CMPunk96]

The technical execution was always the scary part, a human choosing a target is not the hard part of ransomware, doing the actual break in, lateral movement and encryption autonomously is the part that used to require real skill

[Neuer31]

Fair, but the initial coverage oversold it as fully autonomous when a human still handled the highest value decisions, that distinction matters for calibrating how close we actually are to zero human involvement

[CaptainStatic56]

Not knowing which model ran it is the most important open question in the whole story, if it turns out to be a frontier model with safety training that failed, that is an enormous story, if it is a stripped open weight model, that is a different and arguably more containable problem

[Henry25]

The stripped safety training theory feels more plausible to me too, frontier labs have genuinely invested heavily in this exact misuse case, an open model with the guardrails removed is the more likely culprit by a wide margin

[MattHardy]

Either way the skill floor for this kind of attack just dropped significantly, whether a frontier or stripped model did the work, the fact that ANY current model can chain these steps together autonomously is the real headline

[FairDos]

The 31 second recovery from a failed step is the detail that should worry security teams most, that is genuinely faster than any human operator could diagnose and retry, the speed advantage is real regardless of the human involvement nuance

[Blake_32]

Responsibility gets much harder to assign without knowing the model, if it is a frontier lab's product being misused despite safety training, that is a real accountability question, if it is a deliberately neutered open weight model, the blame sits somewhere else entirely

[Reuben]

The correction itself is a good sign honestly, security researchers walking back an overstated initial claim once the full picture emerged is exactly how this reporting should work, better than letting the scarier version stand uncorrected