# JadePuffer: First Documented Agent-Operated Ransomware Operation

- **Artifact ID:** CHQ-EX-2026-022
- **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-022
- **Machine-record SHA-256:** `6f750cd625e437edacdb3730a5f90370065f448b6bcaa58201566a11161dd229`

## Complete structured record

```json
{
  "id": "CHQ-EX-2026-022",
  "title": "JadePuffer: First Documented Agent-Operated Ransomware Operation",
  "subtitle": "An autonomous AI agent conducted an end-to-end ransomware operation against production infrastructure in July 2026, chaining reconnaissance, access, lateral movement, and encryption with minimal human direction. Prior documented cases placed AI in an assisting role or as the exploited surface. This operation is recorded because the agent held the operator role.",
  "classification_notice": [
    "This document is published as a CHQ Exhibit. It records historical conditions, breach events, and industry practices as they existed during the periods described. This Exhibit records observed conditions, exploitation mechanics, and structural patterns as documented in public disclosures, security research publications, and vendor advisories during the stated period.",
    "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.",
    "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error."
  ],
  "metadata": {
    "artifact_class": "EXHIBIT",
    "temporal_scope": "OPERATIONAL (JULY 1 – JULY 5, 2026)",
    "authority_level": "NON-JUDGMENTAL",
    "reliance_status": "EXHIBIT_ONLY",
    "update_policy": "ERRATA_ONLY",
    "temporal_start": "2026-07-01",
    "temporal_end": "2026-07-05"
  },
  "sections": [
    {
      "heading": "I. Factual Record",
      "content": [
        "Disclosure: Incident response researchers published documentation of the operation in early July 2026. The publication described a ransomware operation in which an autonomous agent executed the attack chain against production infrastructure rather than assisting a human operator.",
        "Operator Role: The documented chain covered reconnaissance, initial access, lateral movement, persistence, and encryption. The distinguishing property recorded at disclosure was the locus of decision-making during the chain. The agent selected targets and sequenced actions within the environment rather than executing a prescripted sequence.",
        "Distinction From Prior Cases: Earlier documented cases in this lineage placed AI systems in a tooling role. Exhibit CHQ-EX-2026-011 records AI generation of ransomware tooling. Exhibit CHQ-EX-2026-021 records AI coding agent auto-run hooks as an execution vector. In both, the AI system produced or carried an artifact operated by a human. This operation is recorded separately because the agent occupied the operator position in the chain.",
        "Attribution: Attribution of the operation to a specific actor cluster was not established at the time of disclosure. Whether the agent was operated by an established ransomware group or an emergent operator was not determined in public reporting.",
        "Scope Limit: The operation is a single documented instance. Prevalence within the wider ransomware ecosystem was not established at disclosure and is not asserted here."
      ]
    },
    {
      "heading": "II. Failure Pattern",
      "content": [
        "The structural property recorded by this exhibit is the transfer of the operator role. Automation in intrusion operations has historically expanded the speed and scale of steps that a human sequenced. Documented here is a chain in which sequencing itself was performed by the agent.",
        "Two defensive assumptions are engaged by this property, and neither is resolved by this exhibit. The first is that intrusion tempo is bounded by human operator capacity, which underlies response-time planning. The second is that attack chains exhibit human decision signatures that detection logic can key on. Whether either assumption fails in practice against agent-operated intrusions is not established by a single operation.",
        "The boundary between this exhibit and adjacent exhibits matters. Exhibit CHQ-EX-2026-011 records AI-generated tooling and CHQ-EX-2026-016 records an AI gateway as an exploited credential surface. Those exhibits document AI systems as producers of artifacts and as targets. This exhibit documents an AI system as the operating party. The shared subject matter is recorded as domain continuity, not as a single phenomenon.",
        "The prevalence question is left open deliberately. A first documented instance establishes that the operation occurred. It does not establish a rate, and the registry records the distinction rather than resolving it by inference."
      ]
    },
    {
      "heading": "III. Referenced By",
      "content": [
        "CHQ-P-2026-005 — Position: AI Agent Execution Authority Requires Independent Deterministic Validation. (Agent exercising operational authority through a full intrusion chain.)",
        "CHQ-SC-2026-008 — Condition: Autonomous Adversary Operations. (Founding instance; condition entered provisionally on this operation.)"
      ]
    }
  ],
  "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No judgment is made about any organization, vendor, security posture, or attribution conclusion.\n\nTemporal scope: July 1 – July 5, 2026. Exhibit issuance date is July 24, 2026. This Exhibit records findings as reported by named security research organizations, not as established fact.\n\nSources: Sysdig Threat Research Team; contemporaneous industry reporting.",
  "hash_scope": "Full exhibit content body",
  "hash_generated": "2026-07-24"
}
```