AI Ransomware Is Here, Now Powered By Cheaper, Agentic Models

Sysdig documented JadePuffer, the first known agentic ransomware operation, which used an AI agent to automate reconnaissance, credential theft, lateral movement, and encryption while humans directed the attack. The incident demonstrates that AI is now automating the labour-intensive phases of ransomware campaigns, lowering the skill floor for cybercriminals. If you sell ransomware detection or response tools, your threat model just got cheaper and faster to execute. Criminals now skip the expert operator and run AI—that means more attacks, from lower-skill attackers, and your detection rules built on human behaviour patterns will miss them.