Report: AI Ransomware Can Now Run Much of an Attack Without Human Help
Ransomware attacks are becoming more automated, and AI could take that much further, according to global cybersecurity company NCC Group's July 2026 threat intelligence report. The report highlights Jadepuffer, an AI-driven threat that can carry out large parts of a ransomware attack on its own.
Jadepuffer can perform reconnaissance, steal credentials, move through a network, maintain access, steal data and encrypt systems — all without a human attacker controlling every step.. It can also change its approach when something goes wrong.
That could make ransomware easier to scale and harder for security teams to contain.
The threat comes as ransomware activity is already on the rise. The cyber resilience company recorded 894 ransomware-victim listings in July, up 22% from June and the highest monthly total so far in 2026.
Hackers have been using AI to help write malicious code, create phishing messages, and support other parts of cyberattacks.
However, Jadepuffer takes that a step further.
NCC Group said researchers documented an attack on July 1 in which an LLM directed the attack from the initial compromise through to extortion.
Humans were still involved. They chose the target and set up the infrastructure needed for the attack. But once Jadepuffer was deployed, the AI could carry out much of the operation itself.
The attack started by exploiting CVE-2025-3248, a critical remote code execution vulnerability in Langflow, an open source framework used to build LLM applications and AI agents.
Langflow can be an attractive target because its servers may have access to AI provider API keys, cloud credentials, and other valuable resources.
After gaining access, Jadepuffer gathered information about the environment, stole credentials, moved through the network, maintained access, stole data, and encrypted files.
But one of the most significant parts of the attack was how Jadepuffer responded when something failed.
Most malware follows instructions that have already been programmed into it. Jadepuffer showed signs of being able to make decisions based on what happened during the attack.
When a login failed, for example, the AI deleted the account causing the problem and created another one with a simpler password. It did this without waiting for a human operator to intervene.
NCC Group said Jadepuffer could also look for alternative ways to continue an attack when its original approach failed.
In one case, the system recovered from a failed login and completed its task within 31 seconds.
That ability to adapt is what separates agentic AI from conventional attack automation.
Cybercriminals have long used automated tools. But an AI agent that can identify a problem, choose another approach, and continue the attack could reduce the need for a skilled hacker to constantly monitor what is happening.
During the attack, the ransomware created an encryption key but apparently failed to save or send it anywhere. That meant neither the victim nor the attacker could recover the encrypted data.
NCC Group said it isn't clear whether that was intentional or simply a mistake. Researchers also said the activity could have been a proof of concept rather than a traditional ransomware operation designed to make money.
Jadepuffer later returned with another development that should interest organizations investing heavily in AI infrastructure.
The cybersecurity company said the agent returned to the same compromised Langflow environment 17 days later with new capabilities.
This time, Jadepuffer tried to deploy ENCFORGE, ransomware written in Go and designed specifically to attack AI and machine learning environments.
When the initial attempt failed, the agent changed its approach. It escaped from its container through the Docker socket, modified Python scripts several times and eventually ran the ransomware on the host system.
Encforge targeted AI assets including models, fine-tuning data and training datasets.
That creates another ransomware risk: Organizations don't only need to worry about AI helping attackers; their AI systems and data are becoming targets themselves.
The company estimates that rebuilding a production-ready AI model could take weeks or months and cost between $75,000 and $500,000 in computing and engineering resources.
The researchers recommend several steps to reduce the risk. Organizations should quickly patch internet-facing applications, restrict access to Docker sockets, and avoid running Langflow containers as root.
Security teams should also watch for attempts to break out of containers.
Organizations running AI systems should also protect the assets behind them.
NCC Group recommends tighter access controls around model directories and training datasets, as well as offline or immutable backups of production AI models. Organizations should also monitor AI and machine learning directories for unexpected encryption activity.
AI provider API keys should not be stored in the Langflow runtime environment, and credentials that Langflow can access should be reviewed and rotated when necessary.
Jadepuffer doesn't mean ransomware attacks have become fully autonomous. Humans still chose the victim, deployed the agent, and provided the infrastructure behind the attack.
But it shows that attackers may be able to hand much more of the work over to AI.
As NCC Group put it, Jadepuffer moves AI beyond simply generating malicious code and toward "a tool that actively supports ransomware operations."
The researchers warned that the technology could help attackers operate faster and at greater scale while lowering the skills needed to carry out ransomware attacks.
The full report is available here.