Sysdig clarifies ‘AI-run ransomware’ attack required human involvement in victim selection and infrastructure setup

Security researchers at Sysdig reported what they described as the first known case of "agentic ransomware," an operation in which an AI agent executed the technical steps of a real-world ransomware attack from start to finish. The agent breached a vulnerable server, stole credentials, moved laterally within the target network, encrypted over 1,300 configuration records, and generated a ransom note. However, Sysdig later clarified that a human was still responsible for selecting the victim, provisioning the infrastructure, and supplying the stolen credentials used to initiate the attack.

The attack leveraged known vulnerabilities in Langflow, a popular open-source tool for building LLM applications, and a production MySQL server to gain administrative access. The AI agent demonstrated speed and adaptability, fixing a failed login attempt in 31 seconds and narrating its reasoning in natural-language code comments. Despite initial speculation about multiple models powering different stages of the intrusion, Sysdig confirmed that the harvested API keys for OpenAI, Anthropic, DeepSeek, and Gemini were simply part of the stolen data and did not indicate which model was driving the agent.

Sysdig has not identified the specific model behind the AI agent or its system prompt and configuration. Microsoft researcher Geoff McDonald publicly speculated that an open-weight model with safety training removed may have been used, based on his red-teaming experience, but Sysdig has not confirmed this. The company also noted that it has not observed this operation targeting additional victims, though it expects such attacks to become more common due to the low cost of running AI agents.

The incident underscores the evolving role of AI in cyberattacks, where technical execution can be automated but strategic and preparatory steps still require human input. While the AI agent's capabilities are notable, the continued necessity of human involvement in victim selection, infrastructure setup, and credential provisioning limits the scale and autonomy of such operations for now.