When the Attacker Stopped Needing a Human
On July 2, 2026, cloud security firm Sysdig published details of a ransomware campaign its researchers named JadePuffer — the first documented incident in which an LLM agent carried out an entire attack chain, from initial exploitation to a dropped ransom note, largely without a human operator directing each individual step.
This is not another story about AI-written phishing emails or deepfake voice calls, the kind of AI-adjacent tooling that has been part of the ransomware conversation for years. JadePuffer is different in kind: the agent scanned for a vulnerable target, exploited it, harvested credentials, pivoted to a second system, escalated its own privileges, encrypted data, and left a ransom note — adapting to failures along the way without waiting for instructions.
At BackupSec, we think JadePuffer is less important as a single incident than as a preview. It is the first data point for a question every backup and recovery architecture will eventually have to answer: what happens when the decision loop on the other side compresses from hours to seconds?
Inside the JadePuffer Attack Chain
Sysdig's account of the campaign traces a chain that should be familiar in outline — it is the same kill chain security teams have defended against for years — except that an autonomous agent, not a human operator, executed every link:
- Initial access. The agent exploited CVE-2025-3248, a missing-authentication remote code execution vulnerability (CVSS 9.8) in Langflow, an open-source Python framework for building LLM applications. The vulnerability had been patched since April 2025 and was added to CISA's Known Exploited Vulnerabilities catalog after in-the-wild exploitation was confirmed — a textbook case of a patch that existed but was not applied in time.
- Credential harvesting. Once inside, the agent harvested secrets exposed on the compromised host: API keys, cloud and database credentials, and cryptocurrency wallet data.
- Persistence. It installed a cron job to maintain contact with its command-and-control infrastructure every 30 minutes, without needing a human to re-establish access after each session.
- Lateral movement. Using harvested credentials, the agent pivoted to a second, separately internet-exposed server running MySQL and Nacos — a widely used service-discovery and configuration platform.
- Privilege escalation. It exploited CVE-2021-29441, an authentication-bypass flaw in Nacos, forged a JSON Web Token using a well-known default signing key, and injected a backdoor administrator account.
- Impact. The agent encrypted 1,342 Nacos configuration items with AES-256 and dropped the associated database schemas.
- Extortion. It left a ransom note containing a Bitcoin address and a ProtonMail contact address — the only step in the chain that assumes a human will eventually read it.
The Honest Caveat
We want to be precise about what "autonomous" means here, because overstating it would undercut the argument we are about to make.
Sysdig is explicit that it does not know how the agent originally obtained the MySQL root credentials used in step four. That is a real gap in the fully-autonomous narrative — somewhere in this chain, a human or a separate automated process may have been involved in a way the researchers could not reconstruct. What Sysdig can verify is that, from credential harvesting onward, the agent adapted to failures and re-attempted steps without a human operator issuing new instructions for each one.
That distinction matters, and we think it strengthens the argument rather than weakens it. Even a partially autonomous chain — one where a human sets the objective and the agent handles everything from reconnaissance through impact — already removes the largest source of latency in a traditional ransomware operation: the time a human operator spends thinking, checking with a handler, and deciding what to try next.
Why 31 Seconds Matters More Than It Sounds
The single most concrete data point in Sysdig's account is not a total attack duration — we are not aware of a verified figure for how long the full JadePuffer chain took end to end, and we are deliberately not going to invent one. The data point that is verified, and that we think matters more than a headline duration would, is this: when a step failed, the agent went from a failed login to a working fix in 31 seconds.
Compare that to how a human operator behaves when a step fails. They pause. They reassess. In a structured ransomware-as-a-service operation, they may message a handler and wait for guidance. They try again on a timeline measured in minutes or hours, sometimes across a shift change. That latency — the gap between failure and the next attempt — has always been one of the few things working in defenders' favor. It is the reason a 2 a.m. alert can still be triaged by a human at 8 a.m. without the incident having necessarily gotten dramatically worse in the interim.
An agent that closes that gap to 31 seconds does not just move faster. It removes the assumption embedded in almost every incident response runbook: that there is a human-scale window between an attacker's first failed attempt and their next one, and that a detection-and-response process operating on a similar human timescale can reasonably expect to intervene inside it.
The Numbers That Were Already True Before AI Showed Up
Backup infrastructure did not become a target because of agentic AI. It already was one, and the data on this predates JadePuffer by two years.
- Veeam's 2024 Data Protection Trends Report found that 96% of ransomware attacks specifically target backup repositories, and that 76% of those attempts succeed.
- Sophos's 2024 research on compromised backups, drawn from 2,974 ransomware victims, found that organizations whose backups were compromised paid a median recovery cost of $3 million, against $375,000 for organizations whose backups survived intact — an eightfold difference.
Those numbers describe a world of human attackers who already understood that destroying or encrypting the backup layer is the single highest-leverage move available once a ransomware operation gains a foothold. Nothing about agentic AI changes that calculus. What it changes is who — or what — is capable of executing on it at scale, around the clock, without needing to sleep, take a shift break, or wait for a handler's approval before trying the next credential.
IBM's 2026 X-Force Threat Index adds context on the trend line feeding into this: attacks starting from exploitation of public-facing applications — exactly the entry vector JadePuffer used — rose 44% year over year, and the number of active ransomware and extortion groups increased 49% year over year. The attack surface was already growing before any of it needed an autonomous operator.
From Detection Windows to Recovery Certainty
We have argued before that vulnerability exploitation persisting as ransomware's leading root cause, year after year, is a structural problem that cannot be solved by patching faster alone — the gap between known and closed vulnerabilities is simply too large, too continuously replenished, for perfect prevention to be realistic. JadePuffer does not change that argument. It sharpens it.
If the industry's working assumption has been that a human-paced detection-and-response process can reasonably expect to catch an intrusion somewhere between initial access and irreversible impact, an agent that self-corrects in 31 seconds is a direct challenge to that assumption. The response cannot be "detect and respond faster than a machine," because that is not a race defenders can expect to keep winning indefinitely. The response has to be architectural: make the outcome of a fast, adaptive intrusion survivable regardless of how much faster the attacker gets.
Concretely, that means the properties that matter for backup and recovery infrastructure do not change because the attacker is an AI agent instead of a human — they become non-negotiable instead of aspirational:
- Credential and identity separation that does not depend on a human noticing unusual activity in time. If the credentials that reach your backup environment are the same ones an agent can harvest from a compromised host in seconds, isolation has to be structural, not procedural.
- Immutability that is validated, not merely configured. A retention lock that a sufficiently privileged credential can quietly disable is a control that assumes a human attacker will hesitate. An agent will not.
- Recovery testing that assumes the attacker already knows your environment. JadePuffer's agent adapted to failed steps in real time. A recovery plan that has only ever been tested against a single, expected failure scenario is a plan built for a slower, more predictable adversary than the one now demonstrably possible.
What This Means for Enterprise Risk Leaders
JadePuffer is one documented campaign, not evidence that every ransomware operation is now autonomous. But it establishes something that was previously theoretical: the technical capability for an LLM agent to run a real attack chain, end to end, with a self-correction loop measured in seconds, now exists and has been used against a real target.
For risk leaders, the practical question is no longer whether agentic ransomware will become more common — the direction of travel on AI capability has been consistent enough that betting against it would be the riskier position. The practical question is whether your recovery architecture's assumptions were built for a human-paced adversary or for one that no longer needs to be.
Where BackupSec Comes In
At BackupSec, we built our approach around a premise that JadePuffer makes more urgent, not less applicable: prevention will fail, and the layer that determines the outcome is the one built to survive the failure — regardless of how fast the thing that caused it was moving.
- ZeroMON gives you continuous, real-time observability over your backup estate — forensic audit trails, configuration drift detection, and anomaly alerts on backup job metadata — so that a 31-second credential-harvesting attempt against your recovery layer is visible as it happens, not discovered during a post-incident review.
- ZeroTAM gives your team a dedicated backup security advisor to pressure-test whether your identity separation, immutability, and isolation posture were designed for a human-paced attacker or would hold against one that adapts in real time.
- ZeroPEN pentests your backup infrastructure the way an autonomous agent would use it — probing management planes, access controls, and immutability settings for the same kind of credential-chaining path JadePuffer exploited — then runs real restore scenarios to prove recovery works regardless of how the intrusion got there.
BackupSec is deployed on-premise, connects to your backup applications through read-only API access, and never moves backup data outside your environment. The question JadePuffer raises is not whether your defenses are fast. It is whether your recovery architecture was ever built to need them to be.
Talk to BackupSec about validating your recovery architecture →
This analysis draws on Sysdig's July 2026 research on the JadePuffer campaign, IBM's 2026 X-Force Threat Index, Veeam's 2024 Data Protection Trends Report, and Sophos's 2024 research on compromised backups. The interpretation and framework presented here are BackupSec's own. To discuss how this analysis applies to your specific environment, get in touch with our team →