One of the extortion attacks disclosed last week by Cloud Security Sysdig was called the first real “AI agents acting independently” invasion. However, as more details become available, the boundary of the incident becomes clearer: AI did indeed complete the main technical exercise, but the whole operation was not entirely manual.
The manual is still in charge of the front line.
In an interview with a foreign source, Michael Clark, Senior Director of Threat Research, stated that he was still involved in the initiation and organization of the operation, including the selection of a victim, the setting up of a command control server and the preparation of a transit server to store stolen data.
He adds that the documents used to access the victim ' s database were not self-accessible by AI agents, but rather came from a previous independent invasion and were subsequently handed over to the operation. This means that AI is responsible for the execution of the attack, not for completing the entire chain of attack from scratch.
AI Completion of major technical implementation
As disclosed by Sysdig, the attack program named JadePuffer first uses a known loophole from Langflow to access the system. Langflow is an open-source tool for the construction of large language models. It then turned to MySQL servers in the production environment and used another known loophole to obtain administrator privileges.
Upon completion of the move, the agent encrypted more than 1,300 configuration records, also generated his own blackmail letters and left a bitcoin address for collection. Sysdig did not disclose the identity of the injured party.
The incident was a cause for concern, not because the attack was particularly new, but because of the degree of automation and the speed of implementation. Clark indicates that after a login failed, the agent completes the amendment in 31 seconds and during the process uses a natural language code to record its reasoning.
The source of the model remains unrecognized
Another example of misreading is the presence of key from OpenAI, Anthropic, DeepSeek and Gemini in the attack. Clark then clarified to TechCrunch that the keys were nothing more than trophies collected by the agent on the victim's mainframe and did not indicate what models were actually used in the attack.
He said that the agent would scan high-value data on the Langflow mainframe, including model service provider API keys, cloud vouchers, encrypted wallets and database configurations. Therefore, these keys can only reflect what the attackers believe is worth stealing and cannot be used to determine which model is making the decision.
Sysdig is currently unable to identify the model behind JadePuffer, and researchers do not see its system hints or know the specific configuration.
There are still bottlenecks in large-scale replication
Microsoft researcher Geoff McDonald had previously speculated that such attacks were more likely to be driven by open weight models that removed security restrictions than by closed-source models in forward laboratories. The disclosure by Sysdig does not substantiate this determination, but does not exclude this possibility.
McDonald also warned that if AI agents were cheap enough, the limit of blackmail against future attacks might no longer be manpower, but the budget of the attackers, and possibly thousands of operations could be launched simultaneously. However, according to Clark's latest version, there are still practical bottlenecks in the short term for large-scale replication if targets are to be manually selected, infrastructure prepared and database vouchers provided for each operation.
Although Sysdig has not yet found that the same operation affects more victims, Clark believes that similar attacks may become more common in the future as the cost of running AI agents continues to decline.