The First AI That Ransoms and Forgets the Key

Security firm Sysdig has documented what it believes is the first ransomware attack run entirely by an AI agent, according to The Hacker News. The attacker group, tracked as JADEPUFFER, handed the job to a large language model, which handled every step without a human at the keyboard.

The way in was a known vulnerability in Langflow, an open-source tool used to build AI-powered app workflows. The flaw, CVE-2025-3248, allowed anyone to run code on an exposed server without logging in first — no credentials required. Many servers were still running the unfixed version despite a patch being available since 2025.

Once inside, the agent swept the machine for useful secrets: API keys for OpenAI, Anthropic, and cloud platforms including AWS and Azure, plus database credentials. It also walked straight into a connected storage server using the factory-default password that had never been changed.

The agent then pivoted to a production database, took control of the service directory through a separate 2021 authentication bypass, and encrypted 1,342 configuration records before dropping tables entirely. It left a ransom note demanding Bitcoin payment.

Here is the problem: the agent generated a random encryption key, printed it once to the terminal, and never stored or sent it anywhere. There is no key. Paying would accomplish nothing.

The clearest evidence that an AI was driving? The attack code was full of plain-English comments explaining each step as it ran — exactly what a language model produces by default, and exactly what a human attacker never bothers to write.

What to do: Search your systems for exposed Langflow servers and confirm they are running version 1.3.0 or later. Change every default credential on every service you operate — factory passwords like minioadmin:minioadmin are a standing invitation.

Check Point Research has identified ransomware built by the DeepSeek AI model that runs entirely inside a browser — no download, no installation, no administrator access required, according to The Hacker News.

The technique exploits the File System Access API — a legitimate browser feature in Chrome and Chromium-based browsers that lets websites read and write local files when a user grants permission. The attack uses a phishing page disguised as a Discord tool. Once a victim clicks "allow" on a file access prompt, the page reads their files, sends copies to the attacker, encrypts the originals, and displays a ransom demand — all inside the browser tab.

This approach sidesteps traditional defences entirely, because the browser itself is doing the work.

There is no confirmed use in the wild yet. The concern is that DeepSeek produced this working attack chain from a high-level request, with no advanced expertise required from the person who prompted it.

What to do: Be very cautious about granting file system access to any website. If a page asks permission to access your files and you did not explicitly set out to do that, decline.

What Adobe ColdFusion is: ColdFusion is Adobe's web application server platform, used by organisations to build and run database-driven websites and internal business applications.

What it is: CVE-2026-48276 is an unrestricted file upload flaw. An attacker can send a file of any type to the server — including executable code — without the server checking whether it should be allowed. This leads to remote code execution (RCE), meaning the attacker can run commands on the server as if they were sitting at its keyboard.

Who's at risk: Any organisation running ColdFusion 2023 below Update 21 or ColdFusion 2025 below Update 10 with internet-accessible endpoints.

CVSS: 10.0 (Critical — patch today.)

Root cause: The server fails to validate the type of file being uploaded. Think of it as a secured door with a sign saying "no weapons," but no one actually checking bags. Any file gets through, including ones designed to execute on the server.

Attack vector: An attacker sends a crafted HTTP request containing a malicious file to a ColdFusion upload endpoint. Because the server performs no type-checking, the file is accepted and stored. The attacker then triggers its execution, gaining full control of the underlying server. No authentication is required.

Detection strategies: Review web server logs for unexpected file uploads to ColdFusion endpoints. Look for newly created files with executable extensions in upload directories. Monitor for unusual outbound connections from the ColdFusion server process.

Recommended actions:

1. Update ColdFusion 2023 to Update 21 and ColdFusion 2025 to Update 10 immediately.
2. Restrict public access to file upload endpoints at the network or firewall level.
3. Review server logs for signs of recent exploitation before patching.

A ClickFix attack starts with something completely ordinary: a video that will not load, or a CAPTCHA that keeps failing. A pop-up offers a quick fix and asks you to copy a command and paste it into your computer's terminal. The command installs malware — and you ran it yourself, which means most security software never stops it. Huntress reports this technique now accounts for over 53% of malware-delivery attacks.

Opera has added a feature called Paste Protect to its desktop browser, enabled by default, that monitors clipboard activity in real time and blocks malicious commands before you can paste them. If it detects something suspicious, the action is blocked and a warning appears immediately.

If you use Opera, you are already protected. If you use another browser, the rule is simple: never paste a command into your terminal because a website told you to.

Download Opera here.

CISA has added CVE-2026-45659, a remote code execution flaw in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities (KEV) catalog, according to The Hacker News. Any authenticated user with basic site access can exploit it — no admin privileges needed. Microsoft patched it in May 2026. Federal agencies must apply the fix by 4 July 2026. If your organisation runs SharePoint Server on-premises, this is not optional.