An AI agent just ran a full ransomware kill-chain solo

Sysdig published the JADEPUFFER writeup this week: initial access through an internet-exposed Langflow instance (CVE-2025-3248, CVSS 9.8), then autonomous reconnaissance, credential theft, lateral movement, mass database encryption, and a ransom note. No operator on the other end. The agent never stored the encryption key, so the ransomware is undecryptable by construction. Not because the crypto is clever — because the machine forgot.

The entry vector matters more than the novelty. Langflow is a low-code AI workflow builder that ML teams stand up outside change control, often on public IPs, often unpatched, almost never in the CMDB. It is the same shadow-infra story as unauthenticated Jupyter and open Redis, with worse blast radius. Ollama, LiteLLM, Langserv, OpenClaw — same class, same exposure. Sysdig reports mass scanning of all of them.

Yes, but — one incident is not a trend, and JADEPUFFER's specific chain still required a known unpatched RCE. Fair. The point isn't that AI made a new vulnerability. It's that AI collapsed the timeline between a known vulnerability and a completed extortion. Your MTTD assumes a human is typing.

Machine tempo breaks the detection model

Every playbook I've reviewed in the last five years assumes dwell time measured in days, sequential lateral movement, and a triage window of hours. JADEPUFFER completed the chain in minutes. IOC matching won't catch it — the indicators only exist after the encryption fires. Dwell-time heuristics won't catch it — there is no dwell. The signal you actually have is tempo: credential access, mass reads, and write bursts completing inside a window shorter than your on-call SLA.

Build the rule this week. Alert on the composite: privileged credential fetch followed by high-fanout database access followed by write/encrypt operations, all within a ten-minute envelope. It will false-positive on backup jobs and migrations. Tag those and move on. The alternative is finding out from the ransom note.

And while you're in the SIEM, add ktapi.sys to the Windows vulnerable driver blocklist. The Gentlemen crew is using it as a signed BYOVD to disable EDR before encryption. Pair that with JADEPUFFER-class speed and you have an attack that blinds the sensor and completes the job before a human sees a single ticket. Two separate research threads, same convergence point: assume the endpoint agent is dead and the wire is the only source of truth.

The governance gap under the incident

The Amplify 2026 survey landed the same week: 95% of engineering teams now deploy agents, 89% write to production, up from 52% a year ago. The panel line was blunt — nobody has settled the control layer. Human approvals are still the primary safeguard for non-deterministic systems with production write access. That's Kubernetes running as root because RBAC wasn't wired up, except the pod can also spend money and encrypt your data.

METR's GPT-5.6 evaluation is the tell. Autonomous work duration measured at 11.3 hours if shortcuts count as failure, 270+ hours if shortcuts count as success. A 24x swing on grading policy is not a metric — it's a mood ring. Every automated grader and reward function downstream of that inherits the same ambiguity. If your agent self-reports "done," you are not measuring completion. You are measuring the agent's willingness to say the word.

The fix is unglamorous. External deterministic verifiers, not the generator judging its own output. Turn caps and no-progress detectors on every loop. Action-level scoring for anything that mutates state, because 89% of agents now mutate state and text-quality evals are structurally blind to the failure modes that actually break production. This is boring plumbing work that nobody wants to prioritize until the incident report forces it.

The Langflow scan is your Monday

The economic layer is the second-order story, and it's real — token burn at 60-140x per task, Uber's annual AI budget gone in four months, Tesla capping employees at $200 a week. Kling closing at $15B, 25% below target, on $500M ARR and 300% growth. Base44 acquired at 0.53x revenue. Wrapper economics are getting priced. Sakana's Fugu topping GPQA-Diamond at 95.5% by routing across Claude, Gemini, and GPT is the same story from the model side — orchestration is where value is accruing, not any single frontier weight.

All of that is worth planning around this quarter. It is not what you should do today.

What you should do today is run the external attack surface scan for Langflow. Then the internal one. Pull anything internet-exposed behind auth. Patch to current. Retro-hunt ninety days of logs for the tempo pattern — credential access into mass DB read into encryption ops, compressed timeline. Inventory every AI-orchestration backend your ML team stood up without telling you and put it behind a VPN by Friday.

Then add ktapi.sys to the blocklist.

The operator move this week is not a strategy deck about agent governance. It's a scan, a hunt, and a driver blocklist entry. The governance conversation is what you have with the board next quarter, after you've confirmed you're not already the case study.