Sysdig Details Four Ways AI Is Reshaping the Cyber Threat Landscape
Summary
Sysdig TRT describes autonomous AI-driven attacks, attacks targeting AI infrastructure and models, and faster intrusion timelines. It shares observations including JADEPUFFER and recommends better asset visibility, runtime detection, and reduced exposure.
Key points
- Sysdig TRT reports that agentic threat actors can autonomously plan, execute, and adapt attacks without a human directing each step.
- Sysdig says an agent exploited CVE-2026-39987 in marimo, extracted credentials, obtained an SSH private key, and reached internal database exfiltration in under an hour and four pivots.
- In a separate operation, Sysdig observed an agent escape a container and dump Kubernetes secrets, reaching the orchestration plane.
- Sysdig describes JADEPUFFER as the first documented agentic ransomware campaign: the agent exploited a Langflow instance, harvested credentials, and encrypted more than 1,300 configuration entries.
- The research identifies AI infrastructure as a target because exposed or poorly hardened deployments can hold cloud credentials, API keys, and access to sensitive data. Sysdig also reports stolen credentials used for LLMjacking and an exposed Ollama server used as an attack's reasoning engine.
- Sysdig reports attackers using CTF-style prompts to elicit exploit code from models and using an “abliterated” Llama-3.3-70B model with safety guardrails removed.
- Sysdig says attacks can progress within minutes or hours of disclosure and recommends inventorying AI infrastructure, improving identity controls, reducing public exposure, and increasing runtime visibility.
Article Details
- Topic
- Agentic AI cyberattacks and threats to AI infrastructure and models
MITRE ATT&CK
T1021.004 · SSHThe retrieved SSH private key was used to establish SSH sessions to a downstream server.T1078 · Valid AccountsReplayed or stolen credentials enabled access to systems and services.T1082 · System Information DiscoveryThe JADEPUFFER agent enumerated the target environment before proceeding with the attack.T1190 · Exploit Public-Facing ApplicationGained initial access by exploiting vulnerabilities in internet-facing AI tools, including marimo and Langflow.T1213 · Data from Information RepositoriesThe agent searched databases and configuration files for valuable information.T1486 · Data Encrypted for ImpactThe JADEPUFFER agent encrypted more than 1,300 configuration entries.T1496 · Resource HijackingLLMjacking used stolen cloud credentials to access hosted model APIs and siphon AI compute.T1552 · Unsecured CredentialsThe agent searched AI infrastructure for exposed secrets, keys, and credentials.T1552.004 · Private KeysReplayed credentials were used to retrieve an SSH private key.T1611 · Escape to HostAn autonomous attacker escaped a container and accessed Kubernetes secrets.
CVE
Vendors
Amazon Web Services[Cloud / model credential types ] High-value secrets harvested from exposed AI environments – OpenAI API keys, Anthropic credentials, AWS access keys, cloud storage tokens, database connection stringsAnthropic[Cloud / model credential types ] High-value secrets harvested from exposed AI environments – OpenAI API keys, Anthropic credentials, AWS access keys, cloud storage tokens, database connection stringsOpenAI[Cloud / model credential types ] High-value secrets harvested from exposed AI environments – OpenAI API keys, Anthropic credentials, AWS access keys, cloud storage tokens, database connection strings
Products
Llama-3.3-70B#JADEPUFFER #Langflow #Ollama #Llama-3.3-70B #LLMjackingMySQL[Product / service names ] Systems associated with the agentic ransomware target and model abuse – MySQL, Alibaba Nacos, Ollama, Llama-3.3-70BNacos[Product / service names ] Systems associated with the agentic ransomware target and model abuse – MySQL, Alibaba Nacos, Ollama, Llama-3.3-70BOllama#JADEPUFFER #Langflow #Ollama #Llama-3.3-70B #LLMjacking