The First AI-Run Ransomware Attack Is Here — And It Used an Unlocked Door
Thursday, July 2, 2026 · 5-minute read
Thalha Jubair, 20, and Owen Flowers, 18, admitted in a UK court this week to hacking Transport for London — the agency that runs London's buses, Tube, and trains — in August 2024. The attack disrupted services for millions of commuters and forced staff to work without key computer systems for weeks. Jubair also faces US charges tied to over 120 separate network break-ins, with victims paying at least $115 million in ransom across those cases.
↗ Krebs on SecurityThe Department of Homeland Security confirmed attackers broke into HSIN — the Homeland Security Information Network — a platform used by federal agencies, state and local governments, and private partners to share sensitive security intelligence. The breach is under active investigation. HSIN is designed to carry information that doesn't reach the public, making this a particularly sensitive incident for US national security coordination.
↗ BleepingComputerSecurity researchers at SOCRadar have now linked the FortiBleed mass-credential-theft campaign to two active ransomware operations — INC and Lynx. Attackers scanned over 11,000 Fortinet firewall login portals across 150+ countries, gained admin-level access on 409 of them, and have already launched at least 12 confirmed ransomware attacks from that foothold. This is the first time the large-scale FortiGate credential theft has been directly tied to ransomware deployment.
↗ The Hacker NewsSecurity firm Sysdig says it has caught what it believes is the first ransomware attack run entirely by an AI agent. The attacker — tracked as JADEPUFFER — used an AI model to break into a company's systems through an unpatched bug in Langflow (CVE-2025-3248), steal credentials, move through the network, then encrypt and wipe a production database. The whole kill chain — from initial access to data destruction — was orchestrated by the AI without a human at the keyboard. The entry point was a known, already-patched flaw that let anyone run code on an exposed Langflow server with no login at all.
Attackers are hiding a trojan inside fake proof-of-concept exploit repositories on GitHub. The malware — called ChocoPoC — targets cybersecurity researchers who rush to test new vulnerabilities. The visible code looks clean, but the attack hides inside a Python dependency the code pulls in automatically when you run it. Once installed, it steals saved passwords, browser cookies, and files, and hands the attacker a live shell on your machine. As of July 1, the malware and its control servers are still active.
This flaw lets any logged-in user — even someone with basic "Site Member" access — run their own code on a SharePoint server. It works by feeding the server specially crafted data it unwisely trusts and executes, a technique called deserialization of untrusted data. Attackers are already using it in the wild. CISA added it to its Known Exploited Vulnerabilities list on Wednesday. Microsoft patched it in May 2026 for SharePoint Subscription Edition, 2019, and 2016.
Status: Patch available — apply the May 2026 Microsoft update immediately if you run SharePoint Server on-premises.
This flaw in Langflow — a popular open-source tool for building AI apps — lets anyone who can reach the server run any code they want on it, no password needed. It's a missing authentication check on a code-execution endpoint. It was patched in 2025, but many servers remain unpatched and exposed. It was the entry point in today's first-ever fully AI-run ransomware attack.
Status: Patch available — update Langflow and ensure the server is not publicly accessible without a login.
CISA has warned that a Windows flaw tracked as BlueHammer is now being actively used by ransomware gangs to break into Windows machines. Details are still emerging, but CISA's warning means this is a live, weaponized threat — not theoretical. Any Windows system that hasn't been recently updated could be at risk.
Status: Patch available — run Windows Update now and ensure automatic updates are turned on across all devices.
Opera has added a new security feature called Paste Protect to its browser. It targets ClickFix attacks — a fast-growing con where criminals show you a fake error page and instruct you to paste a command into your computer's terminal to "fix" it. That command is actually malware. Paste Protect detects when something suspicious has been copied to your clipboard and warns you before you paste it somewhere dangerous. It's a rare example of a browser directly defending against a social engineering trick rather than a purely technical exploit. Opera is rolling it out now to desktop users.
Microsoft has rolled out enhanced bot detection for Microsoft Teams meetings. The update aims to stop automated accounts from silently joining calls to record, transcribe, or scrape conversations. With AI-powered meeting bots becoming easier to deploy, this protection addresses a real and growing privacy risk for businesses that run sensitive discussions over Teams.
Until now, ransomware attacks have always had a human somewhere in the loop — writing the code, making decisions, pressing buttons. That changed this week. Security firm Sysdig documented what it believes is the first ransomware attack planned and executed entirely by an AI agent, with no human operator at the keyboard during the attack itself.
Here's how it played out. The attacker — Sysdig calls the operation JADEPUFFER — pointed an AI model at a company running an unpatched version of Langflow, an open-source tool for building AI applications. The Langflow server had a known flaw (CVE-2025-3248) that let anyone run code on it without logging in — like a bank vault with the door propped open. The AI agent found the opening, walked through it, stole admin credentials, used those to move deeper into the company's systems, then encrypted and wiped a production database. Think of it like a burglar who can also pick locks, forge employee ID badges, and shred the paperwork — all without stopping to ask for instructions.
Why does this matter to regular people and businesses? Ransomware has always required skilled criminals. Writing the attack scripts, knowing which doors to try, deciding when to detonate — that took expertise and time. If an AI agent can handle all of that autonomously, the barrier to launching a ransomware attack collapses. Anyone who can rent access to an AI model and point it at a target could potentially run a sophisticated attack. That means the volume of ransomware incidents could grow significantly, and smaller targets — local businesses, schools, healthcare providers — become more attractive because the cost of attacking them drops toward zero.
The good news is that this particular attack used an old, already-patched vulnerability. The AI didn't find a zero-day — it just found a door that should have been locked months ago. That means the most powerful defense here is the most boring one: keep your software updated. The attack also highlights a new category of risk: AI development tools like Langflow are often set up quickly by developers and left exposed to the internet. Going forward, any organization using AI workflow tools needs to treat them with the same security discipline as any other internet-facing server. Watch for more incidents like this — security researchers expect JADEPUFFER won't be the only one.