llm agent

Jul 12, 2026 4 min read

JADEPUFFER: Sysdig Documents First Fully Agentic Ransomware Attack

Sysdig's Threat Research Team published research in July 2026 documenting JADEPUFFER, the first ransomware operation fully executed by an LLM agent — no human operator required at any step after initial access.

img of JADEPUFFER: Inside the First End-to-End Agentic Ransomware Attack

Jul 6, 2026 6 min read

Threat Actors

JADEPUFFER: Inside the First End-to-End Agentic Ransomware Attack

Sysdig has documented JADEPUFFER, a threat actor that used an LLM agent to drive an entire ransomware operation autonomously — from Langflow exploitation through database encryption. The attack encrypted 1,342 production configuration items using an ephemeral key that makes recovery impossible.