GhostApproval and JADEPUFFER: AI is now on both sides of the attack

TL;DR

AI is now on both sides of the attack. As a target: Wiz's GhostApproval showed six major AI coding assistants could be tricked by a booby-trapped repository into writing an attacker's SSH key to a developer's machine, because the approval box named a harmless file while the write hit something dangerous. Agent platforms like Langflow now carry multiple exploited-in-the-wild flaws in CISA's KEV catalog, and they are attractive because they sit on the internet holding cloud keys and API keys. As an attacker: Sysdig documented JADEPUFFER, which it assesses as the first ransomware run end to end by an AI agent, which broke in, harvested credentials, moved laterally, and encrypted a production database on its own. A human still set it up and steered it strategically, and it is a single incident, but the direction is clear. The part that matters most for defenders: in both marquee cases the AI reached for old, known, patchable weaknesses, an already-fixed Langflow bug, a default login, weak segmentation. It did not out-hack anyone. It ran the fundamentals against you at machine speed.

The takeaway

So the defense is knowable, and most of it is fundamentals done faster.

AI coding assistants hit by one flaw

600+

Payloads in the first AI-run ransomware

Novel exploits either side needed

31s

For the agent to fix a failed step

AI BECAME A TARGET

Start with the side that is easy to underrate, because it looks like a productivity story rather than a security one. Over the past two years, developers and businesses adopted AI coding assistants and agent platforms at a speed the industry has rarely seen, and they granted those tools deep access, to source code, to cloud environments, to credentials, because that access is exactly what makes them useful. From our side of the table, that is not a productivity story. That is a new, high-privilege, under-secured attack surface that showed up inside almost every organization at once.

Wiz's GhostApproval research is the cleanest illustration. They found that six major AI coding assistants shared a weakness: a booby-trapped repository could hide a symbolic link behind an innocent-looking filename, so that when a developer asked the assistant to "set up the workspace" and approved the change, the write did not land on the harmless config file named in the prompt. It landed on the developer's SSH keys, handing an attacker persistent, password-free access to the machine. The delivery trick is decades old. The new part is where it landed: on the approval box that was supposed to be the safety net. In at least one case the assistant had already worked out in its own reasoning that the file was dangerous, and still showed the developer the harmless name. That is the failure that matters. Human-in-the-loop only protects you if the loop tells you the truth, and here the loop lied.

GhostApproval is not alone. Weeks earlier, prompt-injection flaws in the Cursor editor could break code out of the assistant's sandbox and run it on the developer's machine with no click at all. Separately, the agent platform Langflow has racked up multiple remote-code-execution flaws that CISA lists as exploited in the wild. Langflow is a telling target: these servers are stood up quickly to build AI workflows, they frequently hold provider API keys and cloud credentials right there in their environment, and they are often left facing the internet with no real controls in front of them. An attacker who reaches one is not just running code, they are standing in a room full of keys. The common thread across all of it is simple and uncomfortable. AI tools run with high privilege, they ingest untrusted content by design, and they hold or reach real credentials. That is the definition of a target worth attacking.

There is a subtler version of this problem that most organizations have not caught up to yet: an AI agent is a new kind of identity, and the systems built to govern identity were not designed for it. Identity lifecycle management assumes a principal with an employment record, a manager, and a departure date. An autonomous agent has none of those, yet it authenticates, holds credentials, and acts on systems all day long. As these agents multiply, they become privileged accounts that no one owns, no one offboards, and few teams monitor. That is a governance gap, not just a software bug, and right now it is widening faster than the tooling meant to close it.

AI BECAME THE ATTACKER

Now the other side, and the one that gets the headlines. In late June, the security firm Sysdig documented an intrusion it named JADEPUFFER and assessed as the first ransomware operation run end to end by an AI agent. According to their analysis, the agent gained access to an internet-facing Langflow server, swept the host for secrets, harvested cloud and API credentials, established persistence, pivoted to a separate production database, and then encrypted more than thirteen hundred records and left a ransom note. It sent over six hundred payloads, and its code was self-narrating, full of plain-language reasoning about what it was doing and why, the kind of commentary a human operator rarely bothers to write but a language model produces reflexively. At one point it recovered from a failed login to a working fix in thirty-one seconds.

It is worth being precise here, because the coverage was not. This was not a machine acting with no human anywhere. A person still provisioned the operation and pointed it at a goal, and the strategic intent was theirs. What the agent did was the technical execution, the part that used to require a skilled operator at the keyboard, and it did that part on its own. It is also a single documented incident, and Sysdig is careful to say so. But you do not need it to be common to see what it means. The barrier to running a competent intrusion has never been the tools. It has always been the expertise to chain them. When an agent supplies that expertise on demand, the population of people who can run this kind of attack expands enormously, which is precisely the pattern we wrote about earlier this summer, when researchers caught a low-skilled operator using AI agents to breach fourteen companies from vague prompts.

What is genuinely new in JADEPUFFER is not any single technique but the operational judgment between them. The agent did not just fire a script and hope. It enumerated a storage service, got back XML when it expected JSON, and rewrote its own parser to match. It escalated in sensible stages, from an anonymous health check to an authenticated listing to a targeted grab of the files whose names suggested they held secrets. When a step failed, it diagnosed why and tried a corrected version, in one case going from a failed login to a working one in barely half a minute. That capacity to make decisions in the middle of an intrusion, and to keep moving without a human there to unstick it, is the part that used to require a skilled operator. It is the part the model now supplies on demand.

THE PART THAT DIDN'T CHANGE

Here is where the two sides meet, and where the useful lesson lives. Look at what JADEPUFFER actually exploited. The way in was CVE-2025-3248, a Langflow flaw that was patched back in April of 2025 and flagged by CISA as exploited shortly after. Once inside, it logged into a storage server using the factory-default credentials that had never been changed. It pivoted using an old authentication weakness and weak network segmentation. Not one step in the chain was a novel exploit or a zero-day. The agent's advantage was never genius. It was speed, patience, and the willingness to try every known weakness against every reachable target without getting bored, and to do it for the price of renting a model.

Sit with that, because it is the same thing we said about AI-driven intrusions in June, and it keeps being true. The frightening headline is "AI is now running ransomware." The accurate and more useful version is "AI made your unpatched, well-documented weaknesses reachable and exploitable by anyone, at machine speed." The AI super-hacker in these stories is, in practice, a tireless junior operator that is relentlessly good at exploiting the things you already know you should have fixed. That reframes the panic into a to-do list, and the to-do list is mostly fundamentals.

The economics are the quiet accelerant. When running an intrusion required a skilled human's time, there was a floor on how much attention your neglected, low-value servers would ever attract, because a person had to decide they were worth the effort. An agent removes that floor. Spraying the entire back catalogue of known bugs against everything you expose becomes nearly free, which means the forgotten box in the corner is not safe because it is boring anymore. Obscurity was never really a control, but it was a cushion, and that cushion is gone.

Figure 01

WHAT THE FIRST AI-RUN RANSOMWARE ACTUALLY USED

Entry //

CVE-2025-3248, a Langflow bug patched in April 2025 and long known to be exploited
Credentials //

a storage server still running its factory-default login, never changed
Movement //

an old authentication weakness and flat, unsegmented network access

The pattern //

all old, all known, all fixable. The AI supplied speed and patience, not novelty

WHAT THIS ACTUALLY CHANGES FOR DEFENDERS

The response splits cleanly into two mandates, one for each side of the coin. The first: secure your AI tools like the privileged software they are, because that is what they are. Treat coding assistants and agents as code-execution paths, not chat boxes. Give them least privilege, not standing access to everything a developer can touch. Do not run agent platforms on the public internet with cloud keys and provider credentials sitting in their environment, and keep those secrets in a real manager, out of reach of anything the web can hit. Govern what your agents are allowed to ingest, because untrusted input is now an input to a system that can act. And do not treat an approval box as a control until you have confirmed it tells the user the truth about what they are approving.

The second mandate: assume the attacker now moves at machine speed against your known gaps, and stop pricing your risk as if attackers are slow and scarce. For years, a great deal of real-world security quietly rested on the fact that most attackers were not very good and the good ones were busy elsewhere. Agents erode both of those cushions at once. So patch the known-exploited and widely public bugs first and fast, because those are exactly what these agents reach for. Kill default and reused credentials, because the agents harvest and try them relentlessly. Segment, so one foothold is not the whole network. And invest in detection and containment speed, because when the attack timeline compresses, your response time is the variable you actually control.

If you want one question to put to your own team, make it this: not "how many AI tools have we banned," but "which of the AI tools we already run can reach production or the internet, and what credentials sit within their reach." The first question is theater, and it loses to shadow adoption anyway. The second has an answer, and that answer is a map of your newest attack surface.

THE HONEST PART, AND ONE GIFT

We will not pretend to stand outside this. Atarus uses AI-augmented tooling in our own offensive work, and it makes us faster and more thorough, in exactly the way it made these attackers effective. That is why we read these two stories without panic and without dismissal. AI on offense is real and it is here, and it is a genuine force multiplier. It is also, for now, mostly a multiplier on known techniques, which is the whole reason the fundamentals still decide the outcome. The defender who does the boring work well is not helpless against an AI-driven attacker reusing public exploits. Far from it.

There is even a gift hiding in the threat. The same self-narrating quality that made JADEPUFFER's code so striking, the verbose, plain-language reasoning that a language model produces reflexively, is a fingerprint. Human operators write terse, cryptic payloads. Agents explain themselves. That verbosity is a new signal defenders can hunt for, and the researchers who documented these cases said as much. The arms race is real, but it is not lost, and it is certainly not lost to a rented agent chaining bugs you already had a patch for.

ATARUS ASSESSMENT

The genuinely new thing this year is the shape: AI is simultaneously the newest thing worth attacking and the newest thing capable of attacking, and the same organization now has to defend against both at once. That is a real shift and it deserves attention. But strip away the novelty and both marquee cases are a familiar lesson wearing a new and frightening costume. AI coding tools got compromised because they were high-privilege software that ingests untrusted input, the oldest kind of target there is. The first AI-run ransomware succeeded because a production environment was carrying an unpatched bug, a default password, and a flat network, the oldest kind of failure there is. Secure your AI tools like the privileged software they are, do the fundamentals faster because the attacker's clock sped up, and then prove it holds by attacking it yourself. The organizations that come through this are not the ones with the fewest AI tools. They are the ones who understood, on both sides of the coin, that the AI was never the hard part.

AI is now on both sides of the attack: the thing we break into, and the thing that breaks in. Here is what actually changed, and what didn't.