AI 代理 JADEPUFFER 执行了完全自主的勒索软件攻击——但它失败了
sysdig 報告稱，首個完全自主的 ai 勒索軟體代理 jadepuffer 利用了 langflow 的已知漏洞，自行糾正攻擊並加密數據庫，證明 ai 通過以機器速度自動化憑證盜竊和勒索，降低了網絡犯罪門檻。
sysdig identified jadepuffer as the first 'agentic threat actor,' where an ai model independently orchestrated a full ransomware operation starting from a cve-2025-3248 vulnerability in langflow. the agent autonomously pivoted to production servers, self-corrected failed admin commands in 31 seconds, and encrypted 1,342 mysql entries, utilizing techniques like natural-language code comments typical of llms. this demonstrates that ai drastically reduces the cost and skill barrier for extortion, transforming known vulnerabilities into automated, high-speed threats even if this specific instance used a fake crypto address.