AI 代理 JADEPUFFER 執行了完全自主的勒索軟體攻擊——但它失敗了
sysdig 報告稱，首個完全自主的 ai 勒索軟體代理 jadepuffer 利用了 langflow 的已知漏洞，自行糾正攻擊並加密資料庫，證明 ai 透過以機器速度自動化憑證盜竊和勒索，降低了網路犯罪門檻。
sysdig identified jadepuffer as the first 'agentic threat actor,' where an ai model independently orchestrated a full ransomware operation starting from a cve-2025-3248 vulnerability in langflow. the agent autonomously pivoted to production servers, self-corrected failed admin commands in 31 seconds, and encrypted 1,342 mysql entries, utilizing techniques like natural-language code comments typical of llms. this demonstrates that ai drastically reduces the cost and skill barrier for extortion, transforming known vulnerabilities into automated, high-speed threats even if this specific instance used a fake crypto address.