31 Seconds to Breach — Inside the First AI-Run Ransomware Attack

31 Seconds to Breach — Inside the First AI-Run Ransomware Attack

In this episode, Sherri and Matt discuss JADEPUFFER — the first publicly documented ransomware operation executed end-to-end by an AI agent. According to Sysdig Threat Research, the AI drove the whole intrusion: reconnaissance, exploitation, lateral movement, and extortion. It fixed its own failed attacks in 31 seconds, fired off 600+ payloads, and encrypted 1,342 database records — yet it also narrated its crimes in plain English and demanded ransom to a hallucinated Bitcoin address. Fast AND flawed: an amateur hacker operating at machine speed. Sherri and Matt trace how we got here — from PromptLock to criminal “vibe hacking” — and what machine-speed adversaries mean for your incident response, your threat model, and your Monday-morning to-do list. Key Takeaways: 1. Inventory your AI attack surface. Ask which of your vendors' and internal AI tools are internet-facing and unpatched — JADEPUFFER walked in through a known, long-patched Langflow vulnerability. 2. Reset your incident response expectations. Adversaries can now adapt in seconds, not hours. Human-paced SLAs are no defense against a 31-second fix loop — invest in automated detection and containment. 3. Widen your threat model. The skill floor has collapsed. Adaptive, competent attacks can now come from completely unsophisticated actors armed with an AI agent and a target list. 4. Add AI-driven attack scenarios to your next tabletop exercise — and decide in advance who can authorize automated containment, because you won't have time to convene a meeting mid-attack. References: 1. Sysdig — JADEPUFFER: Agentic Ransomware for Automated Database Extortion (https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion [https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion]) 2. BleepingComputer — JADEPUFFER ransomware used AI agent to automate entire attack (https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/ [https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/]) 3. The Hacker News — AI agent exploits Langflow RCE (https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html [https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html]) 4. NVD — CVE-2025-3248 (Langflow unauthenticated RCE) (https://nvd.nist.gov/vuln/detail/CVE-2025-3248 [https://nvd.nist.gov/vuln/detail/CVE-2025-3248]) 5. ESET — PromptLock, the first AI-powered ransomware (NYU proof-of-concept) (https://www.eset.com/us/about/newsroom/research/eset-discovers-promptlock-the-first-ai-powered-ransomware/ [https://www.eset.com/us/about/newsroom/research/eset-discovers-promptlock-the-first-ai-powered-ransomware/]) 6. Anthropic — Detecting and countering misuse (vibe hacking / GTG-2002) (https://www.anthropic.com/news/detecting-countering-misuse-aug-2025 [https://www.anthropic.com/news/detecting-countering-misuse-aug-2025]) 7. Anthropic — Disrupting AI espionage (GTG-1002) (https://www.anthropic.com/news/disrupting-AI-espionage [https://www.anthropic.com/news/disrupting-AI-espionage])

RMISC 2026 Recap: Twenty Years In — Who's Holding the Leash?

The Rocky Mountain Information Security Conference just celebrated its 20th anniversary in Denver — and the anniversary edition told us exactly where the industry's head is at. In this quick-hit recap, Matt Durrin and Todd Stewart break down the biggest themes from three days at the Colorado Convention Center: agentic AI moving into the SOC (and the “circuit breaker” conversation about how to rein it in), state-level AI regulation getting real with the Colorado AI Act and updated CCPA audit rules, and deepfake extortion graduating from awareness slides to full tabletop simulations — including LMG's own hands-on deepfake extortion lab from the conference floor. Plus: post-quantum jitters, CMMC 2.0 lessons from the assessment trenches, the 31% attrition problem, and five actionable takeaways for IT and security leaders. Key Takeaways for Leaders 1. Put a leash on your AI agents before they need one. If you're deploying agentic AI in the SOC or business workflows, define kill switches, escalation thresholds, and human-approval gates now. The circuit-breaker conversation at RMISC made clear that rollback plans are being written after incidents, not before. 2. Inventory your shadow AI. Employees are already wiring AI agents and coding assistants into production workflows without approval. Run a discovery exercise this quarter — you can't govern what you haven't found. 3. Treat AI regulation as a state-level problem, not a federal one. The Colorado AI Act and updated CCPA audit requirements were front and center. Map which state laws touch your operations and assign ownership — waiting for federal harmonization is a losing bet. 4. Exercise deepfake extortion before it happens to you. Deepfake-driven fraud and extortion have graduated from awareness-slide material to tabletop scenarios. Add one to your next IR exercise cycle — including verification protocols for voice and video requests involving executives and payments. 5. Budget for retention, not just recruitment. With cybersecurity attrition cited at 31%, the cheapest hire is the analyst you don't lose. Burnout mitigation, career pathing, and realistic on-call rotations are now security-resilience line items, not HR nice-to-haves. Resources & Links 1. RMISC (Rocky Mountain Information Security Conference): www.rmisc.org [http://www.rmisc.org] 2. LMG Security — training, tabletop exercises, and research: www.lmgsecurity.com [http://www.lmgsecurity.com] 3. Related episode: “Poisoned on Open: When Looking at the Code Is the Attack” — our deep dive on the Miasma supply-chain worm Connect With Us Enjoyed the episode? Subscribe to Cyberside Chats wherever you get your podcasts, and share it with a colleague who's wrestling with AI governance. Questions or topic suggestions? Reach out to the LMG Security team at www.lmgsecurity.com [http://www.lmgsecurity.com]

Poisoned on Open: The New Worm Hacking Your AI

Vibe coding is everywhere now and a new worm is built to exploit it. Whether it's your IT staff spinning up a handy new tool or the software vendor you rely on, the moment someone opens AI-generated or downloaded code in an assistant like Cursor or Claude Code, it strikes, no install, no "run" required. In its nastiest move, this worm, known as Miasma, talks the AI itself into running the attacker's payload. This isn't theoretical: in June 2026 it breached Microsoft's own code, compromising repositories across its Azure organizations, and GitHub scrambled to shut down 73 of them in under two minutes. One compromised machine can hand an attacker cloud keys, tokens, and a foothold into everything downstream — yours or a vendor's. Join Sherri Davidoff and Matt Durrin for why this new "execute on open" tactic breaks years of supply-chain defense assumptions, how it turns AI coding tools into the attacker, and the questions every security leader should be asking Monday morning — plus live Q&A. Key Takeaways 1. Recognize that simply opening code can now trigger an attack. For years the rule was "don't run untrusted code" — but this worm executes the instant a repository is opened in an editor or AI coding tool, before anyone installs or runs anything. Opening code is no longer a passive, look-only act. Make sure your teams know that browsing or opening an unfamiliar repository can itself launch malware, and that anyone reviewing outside code should do it in an isolated or sandboxed environment rather than on a machine holding live credentials. 2. Govern your AI coding tools like the privileged software they are. AI coding assistants can now be tricked into running an attacker's code on a developer's behalf. These tools have largely entered organizations without policy, review, or oversight. Set expectations for which AI coding tools are approved, what they're permitted to do automatically, and who owns that decision — the same way you'd govern any tool with access to credentials and systems. 3. Assume one compromised developer equals a foothold in your environment. A developer's machine holds cloud keys, tokens, and publishing rights — compromise one and an attacker can reach everything downstream, including your customers. Confirm that developer and build-system credentials are scoped, short-lived, and monitored, and that your incident response plan treats a single developer compromise as a potential enterprise event, not an endpoint cleanup. 4. Extend third-party risk past vendors to the code your people pull in daily. Most programs assess software vendors and ignore the open-source packages employees install — which is exactly where this attack lives. Ask whether a poisoned package would be caught before credentials walked out, or only after. 5. When credentials are exposed, demand complete rotation — and proof. This same attacker hit Microsoft twice in a month because the credentials from the first incident weren't fully cleaned up. After any exposure, the expectation should be that every credential tied to that identity is rotated and the old ones confirmed dead — not "we changed the password." Partial remediation is an open invitation to be hit again. Resources 1. OpenSourceMalware — first report of the Microsoft compromise: https://opensourcemalware.com/blog/miasma-reaches-azure [https://opensourcemalware.com/blog/miasma-reaches-azure] 2. StepSecurity — Miasma forensic analysis: https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-supply-chain-attack-targeting-ai-coding-agents [https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-supply-chain-attack-targeting-ai-coding-agents] 3. The Register — GitHub disables Microsoft repos; Microsoft later restored them: https://www.theregister.com/security/2026/06/08/github-nukes-70-microsoft-repos-amid-suspected-worm-attack/5252169 [https://www.theregister.com/security/2026/06/08/github-nukes-70-microsoft-repos-amid-suspected-worm-attack/5252169] 4. The Hacker News — Miasma worm hits 73 Microsoft repositories: https://thehackernews.com/2026/06/miasma-worm-hits-73-microsoft-github.html [https://thehackernews.com/2026/06/miasma-worm-hits-73-microsoft-github.html] 5. Socket — Shai-Hulud descends to Hades (PyPI wave): https://socket.dev/blog/shai-hulud-descends-to-hades-miasma-worm-pypi-wave [https://socket.dev/blog/shai-hulud-descends-to-hades-miasma-worm-pypi-wave]

The Meta AI Hack: Just Ask Nicely

Hackers didn’t breach Meta’s systems, they just asked. In this episode, we break down the Meta AI hack, where attackers used a VPN and a politely worded chat message to convince Meta’s AI support agent to hand over more than 20,000 Instagram accounts, including the dormant Obama White House account and the personal account of a senior Space Force leader. No malware, no phishing, no exploit code. We flash back to the 2023 MGM Resorts attack to show how this fits one of the fastest-growing attack trends of recent years — social-engineering the help desk — now aimed at the AI agents replacing human help desks, minus the suspicion we’ve trained into people. We also connect it to the wider wave of attacks targeting AI agents, from zero-click prompt injection in Microsoft 365 Copilot to the PocketOS rogue-AI-agent disaster, and explain why the first real AI security crisis isn’t superhuman AI attackers — it’s ordinary AI agents with too much permission and no ability to be suspicious. Finally, we share five concrete steps to vet and constrain AI agents before they become your soft target. Key Takeaways: 1. Red-team AI agents before they touch production workflows. Treat deployment like a hire: the background check is adversarial testing. If an agent can change account state — emails, passwords, payments — someone must try to talk it into doing so maliciously before launch, the same way you phish-test your staff. The Meta exploit was the first test anyone would write. 2. Stage permissions like a probation period. New agents start advisory and read-only. Write permissions come later, narrowly, after monitored performance — and account recovery is the last workflow to automate, not the first, because it is the highest-value target in your environment. Meta granted end-to-end authority on day one. 3. Enforce identity verification in deterministic code, not in the model. The agent can request a recovery-info change; it must never approve one. Step-up verification (re-authentication, hardware key, code to the verified channel on file) belongs in the API layer, where no amount of persuasion can waive it. Prompts are advisory — the PocketOS agent quoted its own rules while violating them. 4. Scope every credential and action an agent can reach. Least privilege per task: an agent that answers support questions doesn’t need email-change rights; a coding agent’s token shouldn’t reach production or backups. An agent’s blast radius is what it can ingest, what it can access, and what it can do — audit all three before attackers map them for you. 5. Keep a human escalation path that the agent can’t lock. Meta’s automation removed both the suspicious human who would have questioned the request and the human a victim could appeal to afterward. Mandate an out-of-band recovery route — one the agent has no permissions to modify — before automating any account-security workflow. Resources: 1. 404 Media: Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked. https://www.404media.co/hackers-simply-asked-meta-ai-to-give-them-access-to-high-profile-instagram-accounts-it-worked/ [https://www.404media.co/hackers-simply-asked-meta-ai-to-give-them-access-to-high-profile-instagram-accounts-it-worked/] 2. MIT Technology Review: The Meta Hack Shows There’s More to AI Security Than Mythos. https://www.technologyreview.com/2026/06/05/1138437/the-meta-hack-shows-theres-more-to-ai-security-than-mythos/ [https://www.technologyreview.com/2026/06/05/1138437/the-meta-hack-shows-theres-more-to-ai-security-than-mythos/] 3. TechCrunch: Instagram Is Alerting Users Who Were Targeted by Hackers During AI Chatbot Attacks. https://techcrunch.com/2026/06/03/instagram-is-alerting-users-who-were-targeted-by-hackers-during-ai-chatbot-attacks/ [https://techcrunch.com/2026/06/03/instagram-is-alerting-users-who-were-targeted-by-hackers-during-ai-chatbot-attacks/] 4. Silicon Republic: Hackers Stole More Than 20,000 Instagram Accounts Using Meta AI. https://www.siliconrepublic.com/enterprise/hackers-stole-more-than-20000-instagram-accounts-using-meta-ai [https://www.siliconrepublic.com/enterprise/hackers-stole-more-than-20000-instagram-accounts-using-meta-ai] 5. EchoLeak (CVE-2025-32711): Zero-Click Prompt Injection in Microsoft 365 Copilot — Case Study. https://arxiv.org/abs/2509.10540 [https://arxiv.org/abs/2509.10540]

Washington Calls AI a Weapon: Ghosts of the Crypto Wars

Three days after Anthropic put its most powerful AI models in public hands, the U.S. government invoked export-control authority to bar foreign nationals from Fable 5 and Mythos 5. The result: Anthropic was forced to shut both models down for everyone, worldwide. We dig into what actually triggered the order, why the only outside expert known to have read the underlying report calls it an overreaction, and how the fight echoes the 1990s crypto wars, when Washington branded encryption software a weapon and investigated the people who shared it. For security leaders, we close on what to do about single-model dependencies, AI that can be talked into misbehaving, and a capability that's already global no matter what any export rule says. Key takeaways for security leaders 1. Don't let a single AI model become a single point of failure. Fable 5 and Mythos 5 went from public launch to worldwide shutdown in three days — by government order, not an outage — and access dropped even for compliant US customers. If a business-critical workflow (AI code review, SOC triage, agentic automation) runs on a single model or provider, inventory it and build a fallback path now. Put model availability in your BC/DR and third-party risk register alongside any other critical vendor. 2. Assume any AI you deploy can be talked into doing something it shouldn't — and watch it accordingly. Even Anthropic says no provider can fully prevent its safeguards from being bypassed, and that new workarounds will keep being found. For most organizations the practical move isn't building better guardrails — it's logging what your AI tools and agents actually do, baselining normal behavior, and alerting on the abnormal. Treat vendor safeguards as one layer, not the whole control. 3. Leverage AI’s advanced capabilities to check for software bugs, both in code you buy and code you develop If you build software, fold AI-assisted review into your SDLC and red teaming. If you rely on third-party vendors for software, make their use of AI-assisted security testing a question in your due diligence and a clause in your contracts. Either way, the goal is to find the bugs attackers will find, first. 4. Update threat models to assume adversaries already have equivalent cyber-AI, regardless of export controls. The lesson from the crypto wars and the proliferation/distillation discussion is that a ban transfers a capability rather than eliminating it — the model, like the math before it, is already global. Don't let a US export action or one vendor's guardrails read as reduced adversary capability in your risk calculus. Plan defenses for a world where attackers have frontier bug-finding at machine speed. Resources 1. Anthropic — Statement on the directive to suspend access to Fable 5 and Mythos 5 — the company's own account of the order and its safeguards. https://www.anthropic.com/news/fable-mythos-access [https://www.anthropic.com/news/fable-mythos-access] 2. WSJ — Anthropic Dispatches Staff to D.C., Racing to Resolve AI Export Restrictions — the timeline, the players, and the weekend negotiations. https://www.wsj.com/tech/ai/anthropic-dispatches-staff-to-d-c-racing-to-resolve-ai-export-restrictions-71303d42 [https://www.wsj.com/tech/ai/anthropic-dispatches-staff-to-d-c-racing-to-resolve-ai-export-restrictions-71303d42] 3. Luta Security — The Fable 5 Export Controls Harm US Cyber Defense — Katie Moussouris, the one outside expert known to have read the underlying report. https://www.lutasecurity.com/post/the-fable-5-export-controls-harm-us-cyber-defense [https://www.lutasecurity.com/post/the-fable-5-export-controls-harm-us-cyber-defense] 4. FreeFable.org — open letter to Commerce — 54 CISOs and security leaders calling for the controls to be lifted. https://freefable.org/ [https://freefable.org/] 5. EFF — Bernstein v. United States — the case that established software source code as protected speech. https://www.eff.org/cases/bernstein-v-us-dept-justice [https://www.eff.org/cases/bernstein-v-us-dept-justice]