Microsoft has documented what it describes as the first fully autonomous ransomware extortion attack, an incident named JADEPUFFER that the company says shows artificial intelligence has already begun running cyberattacks with little human involvement.
The finding appears in Microsoft’s 2026 Digital Defense Report, published October 1 and drawing on data from more than 165 trillion security signals processed daily .
What happened in the JADEPUFFER attack
In July 2026, the Sysdig Threat Research Team documented JADEPUFFER, the first confirmed fully automated ransomware extortion attack, in which AI-orchestrated systems autonomously identified targets, delivered ransom demands, and managed the extortion workflow with minimal human involvement.
According to Sysdig’s original research, JADEPUFFER gained initial access to an internet-facing Langflow instance through CVE-2025-3248 and ran an adaptive and fully automated campaign, ultimately pivoting to the intended target and running a destructive database-extortion playbook against the victim’s production database server . CVE-2025-3248 is a missing-authentication flaw in Langflow’s code validation endpoint that allows an unauthenticated attacker to execute arbitrary Python on the host.
Microsoft was careful about how far it extended the finding. The company said it has observed AI-orchestrated intrusions that share elements with that activity, at low volumes.
Microsoft stopped short of claiming it caught the JADEPUFFER activity itself, crediting Sysdig’s original research for the discovery.
Attackers are moving faster than defenders can patch
The broader report frames JADEPUFFER as one data point inside a wider shift. Microsoft’s 2026 Digital Defense Report, covering July 2025 to June 2026, describes a near-term period in which attackers collect the benefits of AI first and defenders have to move quickly to close the gap.
” AI is changing the physics of cybersecurity ,” the company said.
Phishing has resurged as an entry point. Phishing was the way in for 23% of the intrusions Microsoft’s incident responders investigated between July 2025 and June 2026, up from 7% a year earlier.
Exploits against public-facing applications rose from 15% to 24% over the same period.
Once inside a network, attackers are also moving quickly to expand their reach. Microsoft found that 52.2% of valid-account intrusions involved additional credential theft.
Frontier AI models tested against simulated attack chains
Microsoft’s report also references an independent evaluation of how far AI models can carry an attack on their own, pointing to a 32-step attack chain against an emulated enterprise environment run by the UK AI Security Institute.
Anthropic’s Mythos and OpenAI’s GPT-5.5 were the first models to show the potential to orchestrate complex attacks on their own, taking control of the whole domain, including the main server and all user accounts, through the 32-step attack chain , in a test environment with no defenders present. According to independent reporting on the underlying evaluation, the models fully completed the chain in roughly two to three runs out of ten attempts, with the original evaluators cautioning that the results do not indicate whether the same models would succeed against a well-defended target. Open-weight models trail closed models in attack orchestration by seven months.
Microsoft was explicit that this remains the exception rather than the rule in real-world attacks, writing that in most real-world operations it observes, complex intrusions “still retain meaningful human direction.”
The report also pointed to AI misuse that predates JADEPUFFER. The s1ngularity malware, spread through trojanized Nx npm packages in August 2025, looked for Claude Code, Gemini CLI or Amazon Q CLI on infected machines and ran them with permissive overrides to hunt for secrets and SSH keys.
It leaked about 2,000 secrets and about 20,000 files from 225 victims.
Why this matters for security teams
Microsoft’s own security tools are intended as part of the counterweight. The report says organizations using Security Copilot summarize threats 60, 70% faster.
But the company’s broader warning is that the exploitation timeline has compressed faster than most enterprise patch cycles can match. The median time from vulnerability discovery in the wild to weaponization has dropped to well below 24 hours.
That gap mirrors the kind of credential and account exposure problems GCN has covered in open-source software supply chains and in recent data on AI-enabled breach costs.
Microsoft’s advice to enterprises remains largely unchanged in substance even as the threat accelerates: patch internet-facing systems quickly, tighten credential hygiene, and treat AI-assisted phishing and automated reconnaissance as now part of the normal threat landscape rather than an emerging one.
