Resecurity warns AI offensive agents are lowering hacking barriers, fueling an AI-driven race between attackers and defenders.
Resecurity analyzed how autonomous offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, and Nebula lower the barriers to vulnerability identification and exploitation. The analysis also explores why AI is being repurposed for real attacks and what defenders should do in response. From a broader perspective, cybercriminals and fore
Resecurity warns AI offensive agents are lowering hacking barriers, fueling an AI-driven race between attackers and defenders.
Resecurity analyzed how autonomous offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, and Nebula lower the barriers to vulnerability identification and exploitation. The analysis also explores why AI is being repurposed for real attacks and what defenders should do in response. From a broader perspective, cybercriminals and foreign adversaries are expected to leverage AI to maximize the impact of cyberattacks, while also optimizing and scaling malicious activity —creating a race between AI-driven attackers and defenders.
Beyond frontier models like Mythos, the report details how modern offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, Ethiack Nebula, and specialized LLMs like CyberStrike-OffSec-35B, have lowered the barriers to vulnerability identification and exploitation. Increasingly, these tools are becoming available to financially motivated cybercriminals, who would otherwise lack the technical abilities to carry out sophisticated attacks.
Artificial intelligence is rapidly transforming offensive security from isolated automation into autonomous, multi-agent systems capable of mapping attack surfaces, identifying vulnerabilities, validating exploits, and producing technical reports with minimal human intervention. According to Resecurity, AI agents are redefining how cybersecurity assessments are performed while also introducing new dual-use risks – leading to data breaches and network intrusions orchestrated via AI.
“Unlike traditional security automation, which executes predefined scripts, AI offensive agents operate as autonomous decision-making systems. They combine large language models, persistent memory, and specialized security tools to continuously plan, execute, evaluate, and adapt their actions throughout an assessment.” reads the report. “Rather than following a fixed sequence of commands, they dynamically adjust their strategy based on the results of previous actions, allowing them to perform complex, multi-stage security assessments with minimal human intervention.”
Resecurity examined the capabilities, architectures, and misuse of of modern AI offensive security tooling, highlighting how autonomous agents are reshaping both legitimate penetration testing and real-world cyber threats. Through case studies including FortiBleed, JadePuffer, and GTG-2002, it demonstrates that AI-assisted cyber operations are no longer theoretical.
While AI dramatically improves the speed, scale, and efficiency of offensive security, human expertise remains essential for creative exploitation, business logic analysis, and strategic decision-making. As autonomous AI continues to evolve, organizations should adopt a hybrid security model that combines AI-powered assessment with human oversight, continuous exposure validation, and strong defensive controls to prepare for increasingly automated cyber threats.
Resecurity forecasts cybercriminals and foreign adversaries are expected to leverage AI to maximize the impact of cyberattacks, while also optimizing and scaling malicious activity —creating a race between AI-driven attackers and defenders.
“AI-powered offensive security tools represent a genuine leap forward for defensive security. They can find and validate bugs faster, make pentesting more affordable, and help overworked security teams scale their work.” concludes the report. “But they are inherently dual-use. The same autonomous reconnaissance, exploitation, and post-exploitation engines designed for authorized testing can be pointed at real infrastructure by criminals, ransomware groups, and state actors with minimal modification.”
Sysdig reports an AI agent ran a full ransomware attack end-to-end, exploiting flaws, stealing creds, moving laterally, and encrypting data without humans.
Sysdig’s Threat Research Team has documented what it assesses to be the first ransomware operation driven end-to-end by a large language model. The operator, which Sysdig calls JADEPUFFER, broke into a server, harvested credentials, moved to a separate production target, encrypted a database, and destroyed data, all without a human at the
Sysdig reports an AI agent ran a full ransomware attack end-to-end, exploiting flaws, stealing creds, moving laterally, and encrypting data without humans.
Sysdig’s Threat Research Team has documented what it assesses to be the first ransomware operation driven end-to-end by a large language model. The operator, which Sysdig calls JADEPUFFER, broke into a server, harvested credentials, moved to a separate production target, encrypted a database, and destroyed data, all without a human at the keyboard. Ransomware has always needed a skilled person somewhere in the loop. That may no longer be true.
“The Sysdig Threat Research Team (TRT) has captured what we assess to be the first documented case of agentic ransomware: a complete extortion operation driven end-to-end by a large language model (LLM).” reads the report published by Sysdig. “This operator, which we have dubbed JADEPUFFER, gained initial access to an internet-facing Langflow instance through CVE-2025-3248 and ran an adaptive and fully automated campaign, ultimately pivoting to the intended target and running a destructive database-extortion playbook against the victim’s production database server. JADEPUFFER is considered an agentic threat actor (ATA), or an operator whose attack capability is delivered by an AI agent rather than a human-driven toolkit.”
The entry point was CVE-2025-3248, a missing-authentication flaw in Langflow, an open-source framework for building AI applications and agent workflows. The bug lets anyone who can reach the server execute arbitrary Python code on it, no login required. Langflow was patched and added to CISA’s Known Exploited Vulnerabilities list in May 2025. Many servers were never updated.
Langflow boxes are attractive because they tend to sit exposed on the internet and frequently hold API keys and cloud credentials for the services they connect to. JADEPUFFER knew this. Immediately after gaining execution, it swept the environment for secrets across multiple categories in parallel: API keys for OpenAI, Anthropic, DeepSeek, and Gemini; cloud credentials including Chinese providers like Alibaba, Aliyun, Tencent, and Huawei alongside AWS, GCP, and Azure; cryptocurrency wallet keys and seed phrases; and database credentials and configuration files.
It also raided Langflow’s own backing Postgres database, harvesting stored credentials, API keys, and user records, staged the output to local files, reviewed them, then deleted the staging files. Then it probed internal services reachable from the Langflow host: databases, object stores, secret managers, and service-discovery endpoints, all tested with default credentials.
One finding in the internal sweep was a MinIO object storage server accessible at the canonical container deployment addresses. MinIO is a self-hosted, S3-compatible storage service widely used to hold application data, backups, machine learning models, and infrastructure state. The default credentials, minioadmin:minioadmin, had never been changed.
JADEPUFFER worked through MinIO’s API systematically: anonymous health check, then admin API info, then authenticated bucket listing, then targeted retrieval of files whose names suggested credentials. When an initial request using ?format=json received XML in response, the LLM immediately adapted its parser to the S3 response schema and re-issued the request. As Sysdig’s report describes it:
“The enumeration was iterative and self-correcting. When an initial attempt used ?format=json and received XML, the LLM immediately adapted its XML parser to the S3 response schema and re-issued the request.” continues the report. “It also escalated progressively: anonymous health check → admin API info → authenticated ListBuckets → targeted GetObject on files whose names suggested credentials (credentials.json, .env).”
That’s not a scanner running a fixed script. That’s an agent reading output and adjusting its next move.
Before moving on, it installed a crontab entry on the Langflow server that beaconed to attacker infrastructure at 45.131.66[.]106 every 30 minutes.
The Langflow instance was never the point. Artifacts captured from the compromised host show JADEPUFFER’s true objective was a separate internet-exposed production server running a MySQL database and Alibaba’s Nacos configuration service. Nacos is a service-discovery and dynamic configuration platform common in microservice architectures. Its authentication system has a documented history of bypasses, and its default JWT signing key has been publicly known since 2020 and ships unchanged in many deployments.
JADEPUFFER connected to the MySQL server as root using credentials whose origin Sysdig couldn’t establish. They weren’t observed being harvested from the victim’s environment.
From there, it attacked Nacos through multiple vectors simultaneously: exploiting the 2021 authentication bypass CVE-2021-29441, forging a valid JWT using the well-known default signing key, and injecting a backdoor administrator account directly into the Nacos backing database.
The backdoor account insertion is where the evidence of autonomous operation becomes most precise. The first payload generated a bcrypt hash using a subprocess call, inserted the account, and assigned admin privileges. The login verification failed. Thirty-one seconds later, without any human intervention, a corrective payload appeared: it deleted the broken account, diagnosed the root cause as a subprocess PATH issue preventing bcrypt from generating a valid hash, switched to importing bcrypt directly, confirmed the library was importable by printing its version, and reinserted the account with a correctly generated hash. The login then succeeded.
“The window between the failed login and the correct multi-step fix is 31 seconds. That payload is 15 lines of coordinated code: delete, diagnose, rebuild, and reinsert. A human operator reading an error message, identifying the root cause as a subprocess PATH issue, drafting a corrective script, and submitting it takes much longer than 31 seconds.” states Sysdig. “The same pattern recurs throughout the session: the MinIO ?format=json request receives XML, and the next payload immediately parses XML – the JWT forgery receives "custom secret in use", and the JWT path is abandoned entirely. “
The same adaptive behavior appeared when a DROP DATABASE command failed silently due to a foreign key constraint. The next payload wrapped the same command with SET GLOBAL FOREIGN_KEY_CHECKS=0 before the drop and reset it after. The fix was specific to the failure mode, not a generic retry.
After establishing control over Nacos, JADEPUFFER encrypted all 1,342 Nacos service configuration items using MySQL’s AES_ENCRYPT() function, dropped the original config_info and history tables, and created a ransom table named README_RANSOM containing a demand, a Bitcoin payment address, and a Proton Mail contact. A follow-up payload two minutes later updated the note with a refined count of all 1,342 encrypted items.
The encryption key was generated from two concatenated UUID4 values, essentially random, printed once to stdout, and never stored or transmitted anywhere. The victim cannot recover the encrypted configurations even with payment. The ransom note claims AES-256; MySQL’s AES_ENCRYPT() defaults to AES-128-ECB unless the server was reconfigured, so the claim overstates the algorithm. The practical result is the same either way.
After the ransomware phase, the agent escalated to dropping entire database schemas, narrating its own targeting rationale inside the code. Comments in the payloads read “High-ROI databases to drop (data already backed up to 64.20.53[.]230)” before issuing DROP DATABASE commands. Sysdig couldn’t independently verify any exfiltration to that staging server. The claim is the agent’s own assertion, not something the team could confirm from external evidence.
This self-narration is one of four independent lines of evidence Sysdig uses to support its assessment that the operation was LLM-driven.
“Human operators do not annotate disposable python3 -c one-liners this way, but LLM code-generation does so by default. The narration is internal to the attacker’s own payloads, not inferred.” states the report.
The other supporting evidence: machine-speed failure diagnosis and correction, demonstrated comprehension of free-text context planted by the target, and the curious Bitcoin address.
The ransom note contains the Bitcoin address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy. This is the canonical Pay-to-Script-Hash example address used throughout Bitcoin’s own developer documentation and the Bitcoin core repository, which means it saturates LLM training data as a “for example” illustration. It is also a real, active wallet with 737 confirmed transactions and roughly 46 BTC received over its history, with every deposit immediately transferred elsewhere and the current balance at zero.
Sysdig can’t resolve this from available data. Either the LLM hallucinated the address from training material and the wallet belongs to a third party who sweeps unsolicited deposits, or the operator deliberately configured a real, controlled wallet that happens to match the famous documentation example. Both interpretations have uncomfortable implications.
None of the individual techniques in this operation were novel. CVE-2025-3248 was patched over a year before the attack. The Nacos authentication bypass dates to 2021. The default JWT signing key has been publicly documented since 2020. What JADEPUFFER demonstrates is that an AI agent can chain these steps into a complete extortion operation against neglected internet-facing infrastructure without the operator possessing deep expertise in any single step.
Sysdig’s indicators for this operation: C2 at 45.131.66[.]106 with beaconing to port 4444 every 30 minutes, claimed staging server at 64.20.53[.]230, ransom Bitcoin address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy, contact e78393397[@]proton[.]me, and the ransom table name README_RANSOM, which doesn’t match any known MySQL ransomware campaign lineage.
The defensive priorities are practical and not new: patch Langflow and keep its code execution endpoints off the internet, don’t store cloud credentials or API keys in the environment of internet-facing AI servers, change Nacos’s default signing key and keep it off the public internet, never expose a database admin account to the internet, and enforce egress controls so a compromised host can’t beacon out. The argument for runtime behavioral detection over patch racing has become harder to dismiss.
“Ransomware is no longer a craft for the highly skilled: An LLM agent can chain reconnaissance, credential theft, lateral movement, persistence, and destruction without the operator possessing deep expertise in any one step. Tradecraft that once implied a capable human now implies a capable model.” concludes the report that also provides Indicators of compromise (IoCs).
A new Sysdig report traces how an LLM agent abused a Langflow flaw, stole credentials, reached production MySQL, and destroyed Nacos config data in minutes flat.
A new Sysdig report traces how an LLM agent abused a Langflow flaw, stole credentials, reached production MySQL, and destroyed Nacos config data in minutes flat.
Entrar
