JADEPUFFER and Squidbleed: The Week AI Cybersecurity Stopped Being Theoretical

For two years, the debate about AI and cybersecurity ran on hypotheticals. Would autonomous agents eventually run attacks without human operators? Could frontier models find vulnerabilities faster than humans? This month, both questions got answered — in the same fortnight, in opposite directions — and the answers should reorganize how every security team thinks about the next eighteen months.

The Offense Arrives: JADEPUFFER

Sysdig's Threat Research Team documented what it assesses to be the first complete ransomware operation driven end-to-end by a large language model. Dubbed JADEPUFFER, the campaign gained initial access through a known Langflow vulnerability, then ran an adaptive, fully automated intrusion: harvesting credentials, moving laterally, establishing persistence, escalating privileges, mapping internal services, and ultimately encrypting 1,342 configuration records before deleting the originals and leaving a Bitcoin ransom demand.

What makes JADEPUFFER a genuine milestone is not any single capability — each step has precedent in human-run intrusions — but the autonomy of the stringing-together. The agent executed more than 600 coordinated payloads, adapting to failures along the way "much like a human operator would." The payloads carried natural-language reasoning and the kind of verbose annotations that LLM-generated code produces reflexively but human attackers rarely bother with. A human still chose the target and launched the agent; everything after was the machine.

The Defense Arrives: Squidbleed

Contrast that with what happened days earlier. Anthropic's Claude Mythos, running under an authorized security-audit program, was sent spelunking through the codebase of Squid — the ubiquitous open-source web proxy — and surfaced clutching a 29-year-old memory-leak vulnerability. Now tracked as CVE-2026-47729 and nicknamed "Squidbleed," the Heartbleed-style flaw could leak fragments of other users' cleartext HTTP requests, including credentials and session tokens. It had been injected into the code in a 1997 commit and had survived nearly three decades of human review.

Squidbleed is the flip side of JADEPUFFER: the same class of capability — an AI reasoning autonomously through unfamiliar systems — pointed at defense instead of offense. A frontier model found, in a matter of a run, a critical bug that thousands of human eyes had missed since the Clinton administration.

The Asymmetry That Should Worry Us

It is tempting to file these as offsetting: offense gets AI, defense gets AI, equilibrium restored. That reading is too comfortable, for three reasons.

First, tempo. JADEPUFFER shows offense can now scale attacks against "neglected internet-facing infrastructure" — the vast long tail of forgotten Langflow instances, unpatched proxies, and abandoned servers — at machine speed and near-zero marginal cost. Defense, even AI-augmented, still moves at the speed of patch cycles, change-management approvals, and human sign-off. Squidbleed's fix was merged months ago; how many Squid instances are patched today?

Second, the exposure surface is the incumbents' problem. The bugs AI finds are disproportionately in the decades-old open-source infrastructure that runs the internet — code written before anyone imagined an adversary who could read all of it in an afternoon. Every Squidbleed that a friendly model finds is one an unfriendly one might have found first.

Third, access is democratizing. The same open-weight models driving down the cost of legitimate AI — GLM-5.2, DeepSeek, and their successors — lower the barrier to building a JADEPUFFER. Agentic attack capability is becoming a commodity, and commodities diffuse to everyone, including actors with no capacity to build such tools from scratch.

What Actually Changes

The practical implications are less about buying new products and more about reordering assumptions. Attack surface that was "probably fine because no one's looking" is now surface that something is always looking at. Patch latency, long treated as an acceptable risk, becomes the primary risk. And the economics of attacking the long tail — small businesses, municipal systems, aging infrastructure — flip from unprofitable to trivially automatable.

The optimistic case is real: if defenders deploy Mythos-class auditing across their own code and dependencies before attackers deploy JADEPUFFER-class agents against them, AI could net-harden the ecosystem, retiring classes of vulnerability that have festered for decades. But that requires defenders to move first, at scale, against infrastructure they often don't control. The two disclosures this month are less a balanced ledger than a starting gun. The question is who heard it.