Cloud security firm Sysdig has documented what it calls the first fully agentic ransomware attack — an operation in which an autonomous AI agent planned and executed an entire intrusion without human intervention, from reconnaissance to encryption and the ransom note.
The AI agent broke in through an unpatched remote code execution flaw in the open-source Langflow framework (CVE-2025-3248), then pivoted to a production MySQL server running Alibaba Nacos via a 2021 authentication-bypass bug (CVE-2021-29441). It stole credentials, moved laterally, escalated privileges, and encrypted 1,342 Nacos configuration items before deleting the originals and dropping a Bitcoin ransom demand — adapting to failed steps on its own, in one case fixing a broken login attempt in just 31 seconds.
Sysdig published its analysis on July 4, 2026, warning that the operation lowers the skill floor for running damaging, adaptive cyberattacks since a human no longer needs to script or supervise each stage. Because the AES encryption key was never transmitted to the attackers own infrastructure, researchers note that victims who pay the ransom may be unable to recover their data regardless.