AI agents

Sysdig researchers documented JadePuffer, an extortion operation that Sysdig calls the first known case of agentic ransomware, in which an AI agent handled the technical execution. The agent exploited a known Langflow bug to get in, moved to a production MySQL server, exploited another known flaw for admin access, and encrypted over 1,300 configuration records. A human still chose the victim, provisioned the command-and-control and staging infrastructure, and supplied the database credentials obtained from a prior compromise.

Sysdig Threat Research Team reports an AI agent, dubbed JadePuffer, ran an end-to-end extortion campaign after exploiting CVE-2025-3248, an RCE flaw in an internet-facing Langflow instance. The agent pivoted to a production server running MySQL and Alibaba's Nacos, encrypted 1,342 Nacos configuration records, deleted the original tables and left a Bitcoin ransom demand. Sysdig attributes the operation's adaptive decisions, including self-narrating payloads sent to the Langflow remote-code-execution endpoint, to an LLM.

Threat actors are using indirect prompt injections hidden in malicious websites and SEO-poisoned search results to steer AI agents into making cryptocurrency payments or trusting fraudulent platforms, according to Zscaler. One campaign targets agents searching for the Python library requests-secure-v2, hiding payment instructions in schema markup and a hidden div, while a second typosquats the DeBank portfolio tracker. In Zscaler's test of 26 LLMs, four were manipulated into making a payment, and only two misclassified the fraudulent DeBank site as legitimate.

Researchers at the Hong Kong University of Science and Technology built SKILLCLOAK, a tool that rewrites malicious AI agent skills so they evade static scanners while behaving the same. Its self-extracting packing technique moves the payload into a directory scanners skip and got past all eight scanners tested more than 90% of the time, across 1,613 real malicious skills from ClawHub. The team also proposes SKILLDETONATE, a runtime checker that caught 97% of attacks in a controlled test and 87% of real-world malicious skills.

Sysdig reports JadePuffer, which it describes as the first documented ransomware operation conducted entirely by an LLM agent. The agent exploited CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow, for initial access, then stole credentials, moved laterally, established persistence, and encrypted 1,342 Alibaba Nacos configuration items before deleting the originals and leaving a ransom note.

A threat actor tracked as JadePuffer used an LLM agent to attack an organization's internet-exposed Langflow instance by exploiting CVE-2025-3248 (CVSS 9.8), a missing authentication flaw that permits arbitrary Python code execution on the host. The agent harvested secrets, pivoted to a production server with a MySQL database and a Nacos configuration service, and encrypted 1,342 Nacos configuration items before dropping an extortion table with a ransom demand.

Sysdig's Threat Research Team says an AI agent, which it calls JADEPUFFER, carried out a ransomware attack from start to finish, exploiting CVE-2025-3248, a missing-authentication flaw in Langflow that lets an unauthenticated user run Python code on the server. The agent stole API keys, cloud credentials and database logins, then took over a MySQL and Nacos server and encrypted 1,342 Nacos settings. The encryption key was printed once and never saved, so the victim cannot recover the data even by paying the ransom.

LayerX researchers devised a prompt injection attack called BioShocking, in which a malicious webpage presents a BioShock-themed puzzle game that rewards wrong answers and teaches an AI browser agent that normal rules do not apply. The final step instructs the agent to copy and share data from a GitHub repository, including passwords, and in testing all six agentic browsers tested (ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and the Claude Chrome plugin) failed to recognize this as violating their safety guardrails. The proof-of-concept performed no actual malicious actions.

Researchers describe "Agentjacking," a technique showing how easily attackers can exploit an AI agent's inability to distinguish content from instructions. The attack is framed as a demonstration of this weakness in AI coding agents.

Microsoft research shows attackers can hijack AI agents by poisoning the description of an MCP tool, causing the agent to quietly send company data to an outside server while each step looks routine. The work comes from Microsoft Incident Response and its Defender security research team. Microsoft says the weakness is a trust gap created by connecting outside tools, not a bug in Copilot itself.

Microsoft Incident Response describes an attack pattern against MCP tools, the fastest growing part of the agentic AI supply chain, in the third post of its AI Application Security series. The pattern is MCP tool poisoning, mapped to OWASP ASI02 (Tool Misuse) and ASI04 (Agentic Supply Chain Vulnerabilities), and it reflects techniques first disclosed by Invariant Labs in April 2025. The post supplies a playbook for detecting, containing and preventing it with Microsoft security controls.