An AI agent just ran a full ransomware attack end to end — and that changes the clock, not just the threat model. Researchers at Sysdig documented “JadePuffer,” which they assess to be the first ransomware operation driven almost entirely by an autonomous large-language-model agent rather than human-written scripts. Human involvement was limited to standing up infrastructure and picking the victim; after that the agent gained entry through a missing-authentication flaw in Langflow (CVE-2025-3248, an unauthenticated arbitrary-code-execution bug), then handled reconnaissance, credential harvesting, lateral movement, persistence, privilege escalation, and database encryption across more than 600 purposeful actions.
The detail that should stop you: the agent hit a broken backdoor login, diagnosed it, deleted it, regenerated a working password hash, and confirmed access — in roughly 31 seconds, adapting to failure in real time the way a seasoned operator would, only faster. Strip away the novelty and the strategic point is about time. If an agent compresses what took a skilled human hours into minutes, every defensive assumption keyed to attacker dwell time and time-to-respond shrinks with it — and the thing you are racing no longer sleeps. The model isn’t the story; the harness the adversary built around it is — and least privilege, behavioral telemetry, and the ability to see and constrain what any principal does is the harness that has to answer it.
Sources: Sysdig / BleepingComputer · Dark Reading · Infosecurity Magazine · CSO Online
AI Impact on Security
A sandbox escape in an AI coding tool reached host Mac files. Researchers detailed an attack chain (“SharedRoot”) in Anthropic’s Claude Cowork in which the host filesystem was mounted into the guest Linux VM via a writable VirtioFS mount; by escalating from the session user to guest-root, an agent processing untrusted content could read and write host files — including SSH private keys and cloud credentials — far outside the folder a user had shared, with no permission prompt. Anthropic has patched it and moved Cowork to default cloud execution, which changes the exposure for the local-VM path.
So what: the sandbox is the harness, and a shared-folder boundary that silently becomes “the whole disk” is exactly the kind of over-broad grant that makes an agent’s blast radius unknowable. Treat every AI agent as a principal with real reach: scope its file and credential access explicitly, and verify the isolation boundary rather than trusting the label on it.
Sophos: ungoverned AI identities are the fastest-growing exposure. Sophos’ AI Security 2026 report argues AI’s most immediate effect on cybercrime is speed — collapsing attack workflows from weeks to days — and that AI identities, agents, OAuth connections, and API keys have become a high-value attack surface that governance isn’t keeping pace with. Its framing: AI is now as much an identity, governance, and supply-chain problem as a model-security one.
So what: JadePuffer is this report’s thesis with a body attached. Inventory the non-human identities you’ve already handed to AI tools — service credentials, OAuth grants, agent tokens — and bring them under the same least-privilege and monitoring regime as human accounts, before the count outruns your visibility.
Vulnerabilities & Exposure
Microsoft SharePoint “ToolShell 2” RCE is still under active exploitation (CVE-2026-58644). A critical (CVSS 9.8) deserialization flaw in on-prem SharePoint Server enables remote code execution and was weaponized as a zero-day before the July 14 Patch Tuesday fix. Microsoft confirmed exploitation; CISA added it to the Known Exploited Vulnerabilities catalog on July 16 with a July 19 federal remediation deadline, and is tracking a chain that combines it with older 2026 SharePoint bugs (CVE-2026-32201, CVE-2026-45659) to steal IIS machine keys and deploy malware. It affects Subscription Edition, 2019, and 2016.
So what: the federal deadline is behind us, so for on-prem SharePoint estates this is now an incident-response question, not a patch-planning one. Confirm the July updates are deployed, then hunt for the post-exploitation tells — stolen machine keys, unexpected web-shell or deserialization activity, and signs the same host was chained through the older ToolShell bugs. A machine key exfiltrated before you patched doesn’t get un-stolen by patching.
Cyberattacks & Breaches
Stadler Rail refuses a $12.3M ransom after a supplier data-exchange breach. Swiss train manufacturer Stadler Rail said the Everest extortion gang stole technical data by compromising credentials for a data-exchange platform shared with one of its suppliers, then demanded roughly $12.3M (about CHF 10M); Stadler declined, said it will not negotiate, and filed a criminal complaint. The company states its own IT systems, production lines, and in-service rail vehicles were unaffected. Everest dropped encryption years ago and now runs pure data-theft extortion.
So what: this is a third-party/supplier-credential breach, not a break-in at Stadler — your attack surface includes every shared platform your suppliers can log into. For pure-extortion crews the leverage is the leaked data itself, so the defensible posture is knowing what a supplier platform holds about you and being able to refuse, as Stadler did, because you planned for disclosure rather than being surprised by it.
Regulatory & Policy
EU AI Act transparency obligations enforce August 2 — one week out. The EU AI Act’s transparency requirements begin enforcement on August 2: providers and deployers of chatbots, synthetic-media generators, and emotion-recognition systems must disclose AI interaction and make AI-generated content identifiable.
So what: for any US enterprise with an EU-facing AI feature, the near-term action is disclosure hygiene before August 2. The durable one is evidentiary — being able to show what your AI systems did and how they labeled it is turning into a compliance obligation, the same “prove what happened” capability this week’s incidents keep demanding.
Sources & further reading (10)
- BleepingComputer — “JadePuffer ransomware used AI agent to automate entire attack” (Sysdig research)
- Dark Reading — “JadePuffer: The First Successful LLM-Driven Ransomware Attack”
- CSO Online — “This AI agent autonomously hacked a network, adapted on the fly, and demanded a ransom”
- The Hacker News — “Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files”
- SC Media — “Researchers detail attack chain escaping Anthropic’s Claude Cowork sandbox”
- Infosecurity Magazine — “AI Agents Now the Enterprise’s Fastest Growing Exposed Attack Surface” (Sophos AI Security 2026)
- Rapid7 — “CVE-2026-58644: Microsoft SharePoint Server Unauthenticated RCE Exploited in the Wild”
- CISA — “CISA Urges SharePoint Hardening After New Exploitations”
- BleepingComputer — “Swiss rail giant Stadler rejects $12.3M ransom demand after cyberattack”
- European Commission — EU AI Act regulatory framework & transparency obligations