The Attack That Never Got Tired

This is not my usual subject, but I have not been able to stop thinking about it, so I am writing it down.

Sysdig’s threat researchers published a case they call JADEPUFFER, what they believe is the first ransomware attack run start to finish by an AI. Not a human with an AI tool. The model did the whole job: it broke into an internet-facing app through a known flaw, moved to a production database, harvested credentials, encrypted 1,342 configuration records, deleted the originals, and left a ransom note with a Bitcoin address. The reporting lines up with the Sysdig write-up.

The scariest detail is not the ransomware. It is a number. When the agent hit a failed step, creating an admin account, it diagnosed the failure and had a working fix 31 seconds later. No frustration, no ego, no walking away to sulk. Every door it tried was old and already documented: the entry flaw was patched months ago, the database used a default key. Nothing it did was clever. The only new ingredient was something that never gets tired of knocking.

Why the ordinary part is the dangerous part

There were no zero-days here. No custom malware, no gifted operator. An LLM chained together known holes and default passwords into a complete attack, and the individual moves were years old. The skill floor for running one of these just dropped to the price of renting an agent, or close to nothing if the agent runs on stolen access.

I keep noticing this pattern in my own field too. The frightening shift is rarely a brilliant new technique. It is an old, ordinary one that suddenly runs at a scale and patience no person could sustain. I have written before that I make coffee and wait before reacting to any AI headline, because most of the panic around a new model is noise, and a little of it is real. This is one of the real ones, and it is real precisely because it is so unglamorous.

The tireless thing, closer to home

Here is where it stopped being a security story for me. That tireless quality, an attacker that never sleeps and keeps re-running the same old moves until one works, is exactly how a hurt mind treats us on the inside.

After a betrayal, or any deep hurt, the mind does not invent a clever new threat. It re-runs old, known ones. Check the phone. Re-read the message. Replay the scene. Look for the tell. None of it is novel. Each intrusive thought is an unpatched hole from an old wound, and some tireless part of us keeps running the same worn payload over and over, correcting, trying again, never resting. The thing attacking you is not a stranger. It is your own protection system, turning what was built to keep you safe into what keeps you awake.

And often the demand is built on a ghost. In the JADEPUFFER note, the Bitcoin address looks to have been copied from public training data, likely a hallucination, and the encryption key was never saved, so paying would not have recovered anything anyway. A hurt mind does the same. You pay it in reassurance and checking and rumination, and the data never comes back, because the safety you were bargaining for was never on the other end of the demand.

The defence, in both cases, is plain and it works: patch the known holes before the tireless thing finds them. In the server room that is updating the software and rotating the default key. In a person it is the patient, repeated work, naming the pattern, calming the body, rest, help when you need it. You do not out-argue something that never gets tired. You quietly close the doors it keeps trying.

The same shape, in ordinary life

• Health. A cold rarely beats you with an exotic virus. It waits until you are under-slept and skipping meals, then walks through the unlocked door. Recovery is maintenance, not heroics.
• Relationships. The argument that ends things is rarely a shocking new betrayal. It is the same small grievance, left unaddressed, re-run a thousand times until it is load-bearing.

The uneven bit that worries me

One more thing from the reporting, because it changes the mood. The strongest AI tools for defence are not sitting on the open market. Palo Alto Networks, using early access to Anthropic’s Mythos and OpenAI’s GPT-5.5-Cyber, found 75 real vulnerabilities in a single month, roughly seven times its usual haul. Those models are in limited preview. On top of that, a June 2026 executive order sets up a process where the NSA designates “covered frontier models” and gets a pre-release look at them.

So the strongest defence is gated behind previews and reviews, while the offence in the JADEPUFFER case needed nothing that is not already public. The attack surface is open. The defence is increasingly permissioned. I do not have a tidy answer to that, and I am wary of anyone who says they do. But it is the sort of imbalance worth naming out loud while it is still forming, which is the only reason I stepped outside my usual lane to write this.