Notifications
Clear all
Topic starter
18/08/2026 2:35 pm
TL;DR: JadePuffer is the clearest sign yet that ransomware can now be run almost entirely by an AI agent, with Xygeni noting researchers at Sysdig describing a campaign that chained reconnaissance, credential theft, lateral movement, persistence, privilege escalation, and encryption into a machine-speed operation. The shift matters because it turns unpatched AI application frameworks, not just phishing, into a direct entry point and compresses response windows beyond human operator pace.
NHIMG editorial — based on content published by Xygeni: agentic ransomware, AI framework exposure, and the JadePuffer campaign
By the numbers:
- Ransomware-as-a-service affiliates can receive profit-sharing splits as generous as 90/10, according to Akamai's Ransomware Report.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when an AI agent is allowed to call tools without strict scope controls?
A: The main failure is privilege expansion.
Q: Why do AI-driven ransomware campaigns compress response windows so sharply?
A: Because the attacker can retry and re-plan immediately after failure.
Q: What do security teams get wrong about AI-driven ransomware?
A: They often focus on whether the malware is novel instead of whether the operator behaviour is familiar.
Practitioner guidance
- Map AI frameworks to the production attack surface Inventory every internet-facing LLM framework, agent orchestrator, and copilot backend, then assign owners, patch SLAs, and exposure reviews as if these were public APIs.
- Restrict agent tool use by default Block unsupervised package installs, config edits, secret reads, and MCP tool calls unless the action is explicitly authorised and logged with a revocation path.
- Add machine-speed containment to incident playbooks Automate credential revocation, session termination, and host isolation so failed logins and privilege jumps are contained before the agent can retry.
What's in the full article
Xygeni's full analysis covers the operational detail this post intentionally leaves for the source:
- How Xygeni's DevAI Agent inspects agent rules, configuration files, and MCP tool calls in runtime workflows
- What its Malware Early Warning layer looks for before a signature exists, including slopsquatted packages and generated payloads
- How the ASPM layer connects findings from third-party scanners into a single workflow for remediation
- Which developer-side controls are used to stop malicious instructions hidden in invisible Unicode or package metadata
👉 Read Xygeni's analysis of agentic ransomware and AI control plane exposure →
Agentic ransomware is here: what should defenders change now?
Explore further
18/08/2026 3:21 pm
Agentic ransomware is now an identity governance problem, not only a malware problem. The article shows that the decisive control failure is not merely payload execution but delegated access that lets an AI system move across tools, credentials, and workflows without a hard runtime boundary. That means IAM and PAM programmes must treat the agent itself as an operating identity with measurable scope, revocation paths, and monitored actions. The practitioner takeaway is simple: if the agent can act like an operator, it must be governed like one.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when an AI agent uses delegated access incorrectly?
A: Accountability should follow the delegated authority chain, not stop at the agent label. The relevant owners are the teams responsible for the human identity, the service identity, the workflow, and the policy that allowed the action path. If those responsibilities are not explicit, incident review will be incomplete and remediation will focus on the wrong layer.
👉 Read our full editorial: Agentic ransomware shows how AI removes the last attack bottleneck
