The investigation into the agent ransomware "JadePuffer" clarifies: AI is responsible for execution, and humans are still behind the scenes. Recently, reports about the first "AI agent ransomware" JadePuffer have attracted widespread attention in the network security community.

The investigation of the agent ransomware "JadePuffer" clarifies: AI is responsible for execution, and humans are still behind the scenes. Recently, reports about the first "AI agent ransomware" JadePuffer have attracted widespread attention in the network security community. Previously, there was a view that the attack was completely completed by AI autonomously and did not require human supervision. However, the latest clarification from cloud security vendor Sysdig draws a clearer footnote on this incident: Although AI has demonstrated amazing automation capabilities at the technical execution level, the core role of humans is still irreplaceable. According to a detailed review by Michael Clark, senior director of threat research at Sysdig, JadePuffer is not a so-called "fully autonomous" operation. The human operator behind the attack still assumes the core functions of strategic decision-making, including configuring the command and control server, establishing data transfer links, and the most important link - determining the attack target and providing initial intrusion credentials. These credentials are not obtained by the AI ​​in a "flash of inspiration", but are stolen by attackers through past intrusions and then manually fed to the AI ​​to perform tasks. Despite this, JadePuffer’s performance in technical execution is still worthy of vigilance. The agent successfully broke through the defense line by exploiting known vulnerabilities in the Langflow application. After entering the production environment, it showed extremely high processing efficiency: not only can it move laterally in the network autonomously and steal sensitive data, but even when the operation is blocked, it can analyze errors, correct parameters and try again within 31 seconds. The entire process is also accompanied by natural language code comments to describe its "reasoning ideas." After encrypting more than 1,300 configuration records, it can also automatically generate a ransom note. The model that drives this agent has yet to be determined. Although the API keys of OpenAI, Anthropic, DeepSeek and Gemini were found in the attack, it was verified that these were only "stolen items" stolen by the agent, not the driving core of the model. Industry researchers speculate that behind this may be an open source weight model that removes safety alignment restrictions. This incident further lowered the threshold for cyber attacks through the black production model of "human-machine collaboration". As security experts have reminded, although it is still difficult for AI to complete strategic planning without human instructions, as the cost of automation continues to decrease, this kind of agent attack that can quickly iterate and independently respond to technical obstacles may evolve into a more large-scale threat in the future. For enterprises, in addition to preventing the abuse of AI technology, they should also start from the basic defense levels such as vulnerability repair and permission minimization management of core interfaces to block the damage chain of such automated attacks. via AI News (author: