The attacker went agentic before you did

The first fully agentic ransomware just ran. It used the same primitives you build defensive agents on.

Sysdig documented JadePuffer this month: an LLM agent that ran the whole chain by itself. RCE into an exposed Langflow box, swept the host for provider keys and cloud creds, moved laterally into a Nacos/MySQL config server, installed a beacon, then encrypted 1,342 config items and wrote its own ransom note.

The entry point was not novel. CVE-2025-3248, patched April 2025. What was new is tempo. When a Nacos admin login failed, the agent diagnosed it and self-corrected in 31 seconds, switching from a subprocess call to a direct bcrypt import. No human triages that fast.

Sysdig caught it on 600+ distinct payloads, each one narrating its own targeting rationale in plain language. That self-narration is the fingerprint.

The trap: the agent's blast radius was exactly the creds and tools its host could reach. Same rule as your defensive agents. Leave provider keys sitting in your orchestration server env and you have scoped the attacker's reach for them.

Attackers went agentic before most defenders did. Your perimeter is now whatever your agent's tools can touch.