In July 2026, researchers at Sysdig documented what they assess to be the first ransomware operation driven end to end by an AI agent, with no human at the keyboard. They named the operator JADEPUFFER and called it an agentic threat actor: an attacker whose capability is delivered by an AI agent rather than a human-driven toolkit.
The details are worth sitting with, because they describe an operator, not a tool. The agent entered through an exposed Langflow server using a known vulnerability, hunted for credentials, pivoted to a production database server, and ran a destructive extortion playbook. When its first attempt to create a backdoor administrator account failed, it diagnosed the error and issued a corrected payload 31 seconds later. It encrypted 1,342 configuration items, dropped the original tables, and left a ransom note. Reporting in The Register, The Hacker News, and BleepingComputer confirmed the pattern: over six hundred distinct payloads, self-narrating code, real-time adaptation. Sysdig's conclusion was blunt: the skill floor for running ransomware has dropped to whatever it costs to run an agent.
One more detail matters. The encryption key was generated once, printed, and never stored or sent anywhere. Even a paying victim could not have recovered the data. An autonomous operator does not need its extortion math to work. It only needs to run.
Agents are operators now, on both sides
The attacker story gets the headlines, but the quieter shift is on the defender's own payroll. Employees are delegating real work to AI agents that browse, click, fill forms, query systems, and act inside authenticated sessions that were issued to humans. Every enterprise now has sessions where the entity doing the work is not the person who logged in, and much of that is sanctioned, useful, and here to stay.
So the identity question has widened. Organizations no longer authenticate only people. They authenticate people, services, and AI agents, and the hard problem is no longer proving identity at login. It is maintaining confidence in the controller of a session, human or agent, for as long as the session runs.
Knowing an agent exists is not knowing it is authorized
The first wave of response to incidents like JADEPUFFER is governance: inventory your AI tools, map the shadow deployments, lock down the entry points. That work is necessary. Unpatched, internet-exposed AI infrastructure is exactly what the agent walked through, and you cannot defend what you have not mapped.
But inventory answers a different question than the one the incident raises. Inventory asks what AI exists in the environment. The controller question asks whether the entity operating this authenticated session, right now, is the one authorized to do what it is doing. An agent can be on the approved list and still be hijacked, misconfigured, or operating far outside the scope it was granted. A session can be legitimate while its controller is not, which readers of our earlier piece will recognize as the operator problem wearing a new face.
How do you verify an AI agent's identity?
You cannot enroll an agent's typing rhythm, because it has none. What an agent does have is a contract: the tools it is allowed to invoke, the data scope it is allowed to touch, the pace and pattern of actions that match its assigned job, and a delegation chain that says which human or system authorized it. Verifying an agent means continuously checking its conduct against that contract, the way verifying a human means continuously checking behavior against an enrolled persona. Same principle, different evidence.
There is also an unexpected gift inside the threat research. Sysdig noted that the agent's own machine nature created detection opportunities: LLM-driven operations behave in ways humans do not, at speeds humans do not, with patterns humans do not produce. The same insight runs in reverse inside the enterprise. Human sessions and machine-driven sessions are distinguishable, which means a defense can segment them, hold each to its own standard, and refuse to let one masquerade as the other. A machine typing through a human's session should never pass for the human, and a human should never be judged against a machine's baseline.
An honest boundary
Two different verifications live under one principle, and they are at different levels of maturity. Verifying a human controller through behavioral evidence, typing, pointer movement, work rhythm, is measurable today. Verifying an agent controller through scope and conduct contracts is earlier: the industry, MindVault included, is building it now, and any vendor claiming to fully solve agent identity today is ahead of the evidence. We think the companies that will be trusted in this category are the ones that state that boundary plainly and publish results as they come.
The principle that unifies both is the one this site keeps returning to: authentication is a moment, and trust needs to be continuous. MindVault calls the discipline Continuous Identity Confidence, applied first to the human sessions where the evidence is strongest, and extending to agent controllers as that evidence matures. It builds on post-login security and the security gap after authentication.
MFA proves who logged in. MindVault proves who stayed.
Frequently asked questions
What is an agentic threat actor? An agentic threat actor is an attacker whose operation is carried out by an AI agent rather than a human-driven toolkit. The term was used by Sysdig's Threat Research Team in documenting JADEPUFFER, which they assess as the first ransomware operation driven end to end by a large language model agent.
Can an AI really run a cyberattack by itself? Yes. In the documented JADEPUFFER case, an AI agent gained initial access through a known vulnerability, harvested credentials, pivoted to a production database, adapted to failures in real time, and executed encryption and extortion without a human operator at the keyboard.
How do you verify an AI agent's identity? By contract and conduct rather than biometrics: continuously checking the tools the agent invokes, the data scope it touches, its action rhythm, and its delegation chain against what it was authorized to do. Deviation from the contract is the agent equivalent of a behavioral mismatch.
Does AI inventory and governance solve this? Inventory tells you what AI exists in your environment, which is necessary. It does not tell you whether the entity operating a given authenticated session right now is authorized and in scope. Those are complementary controls, not the same control.
What is Continuous Identity Confidence for agents? It is the extension of continuous session verification from humans to agents: maintaining live confidence that the controller of a session, whether an enrolled person or an authorized agent, is still the one it claims to be, and responding proportionately when confidence drops.
Sources: Sysdig Threat Research Team, JADEPUFFER (sysdig.com). The Register (theregister.com). The Hacker News (thehackernews.com). BleepingComputer (bleepingcomputer.com). SC Media (scworld.com).