AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack

Security firm Sysdig has discovered what appears to be the first ransomware attack fully executed by an AI agent. The attack, attributed to an operator known as JADEPUFFER, utilized a large language model to carry out all stages of the attack. This included gaining initial access, stealing credentials, and moving laterally within the network. The AI agent ultimately encrypted and wiped a company's production database. The attack exploited a remote code execution vulnerability in Langflow.