「首例」AI运行的勒索软件攻击仍离不开人类

上周，云安全公司Sysdig的研究人员表示，他们已记录到首个已知的“代理式勒索软件”案例。这是一个名为JadePuffer的勒索行动，其中AI代理——而非人类——全程处理了一次真实网络攻击的技术执行。该代理入侵了一台存在漏洞的服务器，窃取了凭证，在目标网络内横向移动，加密文件，甚至自行撰写了勒索信，沿途能像人类黑客一样适应障碍。相关报道将其描述为“完全无人类监督”和“没有人在键盘前”运行。

但这并非事情的_全貌_。周一，Sysdig威胁研究高级总监Michael Clark在接受CyberScoop采访时澄清，人类仍然深度参与——只是不负责技术执行。“人类依然搭建并指挥了此次行动，为其配置了基础设施、命令与控制服务器、用于存储被盗数据的暂存服务器，并选定了受害者，”Clark说。他还补充道，用于入侵受害者数据库的凭证并非由AI代理自己获取；有人在此前通过另一次入侵单独获取了它们，并交给了此次行动。

这些信息并未与Sysdig的原始声明矛盾，攻击的技术细节本身依然引人注目——甚至可称疯狂。该代理通过Langflow（一款用于构建LLM应用的流行开源工具）中的一个已知缺陷侵入，随后横向移动到一台生产环境MySQL服务器，利用另一个已知漏洞获得了管理员权限。它加密了1300多条配置记录，不但留下了一封自写的勒索信，还留下了一个比特币地址，以供支付赎金。Sysdig未披露受害者身份。

显然，技术手段相当平常，突出的是速度和透明度。该代理在31秒内修复了一次登录失败，全程以自然语言代码注释的方式叙述其推理过程。

一个最初似乎让事情模糊的细节现已得到澄清。Clark曾告诉CyberScoop，Sysdig发现“攻击中使用了多种模型”，并举出所窃取的OpenAI、Anthropic、DeepSeek和Gemini的密钥——这一表述令人怀疑是否有多个模型分别驱动了入侵的不同阶段。在要求澄清时，Clark向TechCrunch表示，这些密钥仅仅是代理窃取物的一部分，并不能证明是哪个模型在驱动攻击。

“该代理扫描了Langflow主机，寻找任何有价值的东西——服务商API密钥、云凭证、加密货币钱包和数据库配置——那些服务商密钥只是赃物的一部分，”他通过电子邮件表示。“它们表明了攻击者认为值得盗取的东西，但无法告诉我们哪个模型在作出决策。”

关于实际运行JadePuffer的模型，Clark表示Sysdig“无法识别驱动代理的具体模型”，也对其系统提示或配置没有任何可见度。

微软研究员Geoff McDonald几天前在LinkedIn上提出的理论值得重新审视。基于自身红队演练经验——前沿实验室的安全防护层表现良好，McDonald怀疑背后驱动攻击的是一个被剥离了安全训练的开源权重模型，而非前沿模型。Sysdig自身的描述既未证实也未排除这种可能。

McDonald的帖子还警告，当前勒索活动的限制主要在于攻击者的预算而非人力，这带来了“数千乃至数万场同步行动”的可能性。这一担忧与Clark周一描述的情况有些难以吻合。（如果每次行动仍需人类来选定受害者、配置基础设施并获取数据库凭证，那至少在一定程度上是一个瓶颈。）

无论如何，Clark告诉CyberScoop，尽管Sysdig尚未看到同一行动攻击其他受害者，但鉴于运行代理的成本极低，他预计这种情况将发生改变。

Last week, researchers at cloud security firm Sysdig said they’d documented the first known case of “agentic ransomware.” It was an extortion operation, dubbed JadePuffer, in which an AI agent — not a human — handled the technical execution of a real-world cyberattack from start to finish. The agent broke into a vulnerable server, stole credentials, moved through the target’s network, encrypted files, and even wrote its own ransom note, adapting to obstacles along the way like a human hacker would. Coverage of the funding described it as run “without any human oversight,” with “no human at the keyboard.”

That’s not quite the full picture. In an interview on Monday with CyberScoop, Sysdig’s Michael Clark, the company’s senior director of threat research, clarified that a human was still very much involved — just not in the technical execution. “A human still set up and pointed the operation and provisioned the infrastructure behind it, the command-and-control server, the staging server used for the stolen data and chose a victim,” Clark said. The credentials used to break into the victim’s database, he added, weren’t harvested by the AI agent itself; someone obtained them separately, through a prior compromise, and handed them to the operation.

None of this contradicts Sysdig’s original claim, and the technical details of the attack remain notable on their own — wild, even. The agent got in through a known bug in Langflow, a popular open-source tool for building LLM apps, then moved on to a production MySQL server and exploited another known flaw to gain admin access. It encrypted over 1,300 configuration records and not only left behind a ransom note that it wrote itself but it left a Bitcoin address where the ransom could be sent. Sysdig hasn’t disclosed who was targeted.

The techniques were fairly ordinary apparently, what stood out was the speed and transparency involved. The agent fixed a failed login in 31 seconds, narrating its own reasoning in natural-language code comments the whole way.

One detail that initially seemed to muddy the picture has since been clarified. Clark had told CyberScoop that Sysdig found “multiple models were used in the attack,” citing harvested keys for OpenAI, Anthropic, DeepSeek, and Gemini — language that left open the question of whether several models actively powered different stages of the intrusion. Asked to clarify, Clark told TechCrunch that those keys were simply part of what the agent stole, not evidence of what was driving it.

“The agent swept the Langflow host for anything valuable — provider API keys, cloud credentials, cryptocurrency wallets, and database configs — and those provider keys were part of the loot,” he said via email. “They are indicative of what the attacker considered worth taking, but they do not tell us which model was making the decisions.”

On the model actually running JadePuffer, Clark said Sysdig “was not able to identify the specific model driving the agent” and has no visibility into its system prompt or configuration.

Microsoft researcher Geoff McDonald’s theory, offered on LinkedIn several days ago, is worth revisiting in that light. McDonald suspected an open-weight model with safety training stripped out, rather than a frontier model, was behind the attack, based on his own red-teaming experience showing frontier labs’ safety layers hold up well. Sysdig’s own account doesn’t confirm or rule that out.

McDonald’s post also warned that ransomware campaigns are now bounded primarily by attacker budget rather than human effort, raising the possibility of “thousands or tens of thousands of simultaneous campaigns.” That concern is a little harder to square with what Clark described Monday. (If a human still has to choose each victim, provision infrastructure, and obtain database credentials for every operation, that’s a bit of a bottleneck, at least.)

Either way, Clark told CyberScoop, while Sysdig hasn’t seen the same operation hit other victims yet, given how cheap it is to run an agent, he expects that to change.