In one week, the attacker’s side of the AI story stopped being a forecast and became a set of case files.
Sysdig documented an intrusion it calls JADEPUFFER — the first known ransomware operation run end to end by an AI agent, not a human. The agent found an exposed company server, walked in through a known flaw, hunted the machine for passwords and keys, moved to a production database, and ran a full extortion playbook, adapting as it went. It hit an error and had itself working again in about thirty-one seconds, and fired off more than six hundred separate, purposeful actions. No human works that fast — and no human writes running commentary into their own attack the way this one did, the tell-tale fingerprint of a machine writing as it goes.
Here’s the detail worth sitting with. The agent locked up the database, deleted the originals, and demanded Bitcoin — but when it scrambled the data, it threw away the only key that could unlock it. The victim can’t recover even if they pay. That’s not a competent extortionist; that’s a machine optimizing for finishing the task, with no grasp of the business it’s supposedly running. The skill required to run an attack has collapsed, and the thing now running attacks doesn’t fully understand what it’s doing. Both are dangerous.
Stack that next to three more from the same week.
First, Check Point started with malware the AI model DeepSeek had written — confirmed by a scanning service as working ransomware, not an experiment — and pointed it at a real attack path defenders had written off, a ransomware that runs entirely inside your web browser. That’s the critical part: it’s why your endpoint stack is blind to it — nothing gets dropped to disk, nothing spawns a suspicious process, the “malware” is a web page using a sanctioned browser feature the user clicked “allow” on. AI didn’t just help write it; it found the technique.
Second is a ready-made kit called Avalon. One package bundles everything an intrusion needs — stealing passwords, spreading through the network, disabling backups, encrypting files — delivered by a phishing email disguised as a legal document. Researchers assess it was assembled with AI help: put together fast, without a seasoned operator’s discipline. And it hunts the defender’s own eyes — it runs in memory and switches off the sensors that security tools depend on before it does anything. The researchers cataloged the products its evasion code checks for by name — Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic, FortiEDR, ESET, McAfee, Bitdefender — not as a verdict on any of them, but as evidence of the point: it treated the entire endpoint-security leaderboard as a single obstacle to design around. That every serious product is on the list is the tell — the kit was built to beat the category, not a vendor.
The third, and this one isn’t bad news: the same capability runs on defense. Anthropic’s Claude Mythos preview autonomously found large numbers of unknown vulnerabilities across every major operating system and browser and built working exploits — one in under a day, for under two thousand dollars. The same week, runZero found seven flaws in a code library buried in millions of devices simply by pointing an AI assistant at the code. AI is finding and fixing flaws faster, too. It’s not magic and it’s not exhaustive — but the direction is unambiguous.
The real question is not whether AI makes attackers more dangerous. It obviously does. The real question is which of your controls stop working when it does — and which ones hold.
For years, three things kept attackers in check because they were scarce: imagination, skill, and time. In one week, all three got cheap at once. It takes imagination to find a new attack path — and a model surfaced an attack path humans had dismissed as impossible. It takes skill to run an intrusion — and an agent ran the whole operation itself. It takes time to build the tooling — and a kit was assembled faster than tradecraft could keep up.
Now ask which defenses lean on those scarcities. Signature-based detection assumes attackers reuse known techniques — a browser-only path using a sanctioned feature defeats it without trying. The endpoint agent as the primary control assumes malware runs where it can see it and won’t be built to blind it — Avalon breaks that on purpose. And a response model whose fastest path is a human working an alert queue assumes the adversary moves at human speed — JADEPUFFER settles that; by the time a junior analyst has opened the ticket, the agent has grabbed the keys and moved. The uncomfortable part is that these are exactly the controls many programs still treat as their center of gravity: the signature, the endpoint agent, the human as first responder.
So what holds? The thing an attacker can’t design around, because it doesn’t live on the endpoint they’re evading: monitoring and correlating behaviors across the whole environment. Not “does this file match something we’ve seen,” but “does this pattern — this account, touching this data, moving this way, at this hour — look like an intrusion, no matter what tool produced it.” An AI-built kit can hide from every endpoint product on the market and still must do something visible somewhere else: log in, grab credentials, reach across to another system, delete the backups, push data out. You catch those by watching behavior across your environment — everything visible from one place, connected, with something watching across all of it. That’s not a new thesis for me; it’s the visibility and data-foundation argument I’ve made for years. This has always been a requirement, never a preference — but the week changes how much it now demands: more attention, better configuration, and updating to the latest capabilities, because it’s the only position that survives an AI-era adversary. Attackers now move faster than any human queue, so detection must be wired to a response that acts at the same speed, with people supervising the machine rather than being the first click.
I won’t sell fear, because the evidence points somewhere more useful. AI isn’t an unstoppable attacker; it’s a capability, and it’s on both sides. The defender who wins isn’t the one who buys the loudest AI agent — it’s the one who feeds that capability the broadest, cleanest data and holds it to reasoning you can audit. Within a year, an AI agent in the SOC will be handling most of the Tier 1/2 tasks and will be table stakes, so it won’t differentiate anyone. The two things an AI attacker can’t engineer around are the breadth of data the agent reasons over and the transparency of how it reasons. For a board, it isn’t time to buy another tool (unless it is Splunk ;)): the marginal dollar is better spent unifying the telemetry you already generate than adding a tenth surface for an attacker to blind.
This week, AI didn’t just help with an attack — it built one and ran it. That changes the job: stop trying to build a better wall, and start building better sight. Attackers have optimized against the controls that watch the door and the host. What still works is watching what happens after they’re inside — everywhere, at once, fast enough to matter.
You cannot secure what you cannot see. That was true before the models got good. It’s the only thing that got more true this week.
Sources
- Sysdig Threat Research — “JADEPUFFER: Agentic ransomware for automated database extortion”
- The Hacker News — “AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack”
- Check Point Research — “Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique”
- The Hacker News — “AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android”
- The Hacker News — “New Avalon Malware Framework Packs CrownX Ransomware Capabilities”
- Blackpoint Cyber — “Vibe Coded Extortion: Avalon’s Path from Legal Lure to CrownX Ransom Capabilities”
- Anthropic (red team) — “Assessing Claude Mythos Preview’s cybersecurity capabilities”
- runZero — “Seven FatFs bugs, one very large blast radius”
