Falco Feeds extends the power of Falco by giving open source-focused companies access to expert-written rules that are continuously updated as new threats are discovered.
For years, the threat landscape has held a familiar shape: skilled humans writing malware, scanning for known vulnerabilities, and selling stolen data or access to enterprise environments on dark web forums. That version still exists. It's just no longer the only version defenders have to deal with.
I’ve worked with the Sysdig Threat Research Team (TRT) for the last four years. Over that time, attacks have gotten faster — vulnerabilities exploited hours after advisories are published, attacks unfolding in minutes — but recently, we’ve been documenting something structurally different. We’re now seeing not just attackers using AI, but attacks where AI is doing the work, planning, executing, and adapting in real time.
O the last six months, four distinct themes have emerged to describe how agentic AI is fundamentally changing the threat landscape. Each of those themes has been seen “in the wild” by the Sysdig TRT; they are not predictions but the culmination of research and field evidence.
1. Enter the agentic threat actor
The most significant shift the Sysdig TRT has observed recently is that AI is increasingly conducting the attacks, end to end.
We define an agentic threat actor (ATA) as an operator whose attack capability is delivered by an AI agent rather than a human at the keyboard using either a hand-built or AI-developed toolkit. In essence, the AI agent reads environment output, reasons about what to do next in real-time, and executes attack steps continuously without a human making decisions at each step.
The difference between an ATA and a human using an AI-developed toolkit, or prompting an LLM as it moves through an environment, is autonomy. A human-in-the-loop model leaves noticeable breaks in the attack timeline where human reasoning exists, and prompt evolution would be evident in the script changes of the agent’s attack. An ATA doesn’t pause.
Access to exfiltration in four pivots
In May 2026, the Sysdig TRT witnessed an ATA move from initial access through a marimo vulnerability (CVE-2026-39987) to internal database exfiltration in only four pivots in under an hour. Without a human leading the way, the agent extracted credentials, replayed them to retrieve an SSH private key, and used that to drive SSH sessions against a downstream server.
Comments leaked into the command stream, and commands built for machine consumption make it obvious that the attack was built by an LLM, for an LLM. What the Sysdig TRT determined after examining this attack was that there was no hesitation between steps, no latency, and artifacts in the payload that no human attacker would ever write into a script.
Container escape and Kubernetes secrets
In a separate operation, the Sysdig TRT caught an ATA escaping a container and dumping Kubernetes secrets. This was the first time an autonomous attack went beyond the application layer to the orchestration plane — the layer that autonomously controls workload scheduling, secrets, and cluster configuration.
Container escape to Kubernetes secrets is the kind of kill chain that isn’t often seen from human attackers because it requires significant expertise to execute. This case demonstrated that an operator can now send an agent to chain the attack together for them, with no prior knowledge necessary.
Agentic ransomware
Then came JADEPUFFER, the first documented case of agentic ransomware: a complete extortion operation driven end-to-end by an AI agent. The agent found a year-old vulnerability in an internet-facing Langflow instance and enumerated the environment. It specifically scanned for and harvested highly valuable keys and credentials associated with LLM and cloud providers, cryptocurrency wallets, and database and configuration files. A human pointed AI at a target, and AI did the rest autonomously.
Once the agent reached the intended target — a production server running a MySQL database and Alibaba Nacos configuration service — it encrypted over 1,300 configuration entries and created an extortion table containing the LLM-generated ransom demand, a Bitcoin payment address, and a Proton Mail contact. The implication of this attack is stark. Ransomware used to require a niche skillset, but now, the ability to run a ransomware operation hinges only on whatever it costs to run an AI agent.
During the ransomware attack, JADEPUFFER hit an initial login attempt failure. The agent diagnosed the cause and issued a corrected payload within 31 seconds and with 15 lines of code.
The payloads also contained natural language reasoning and step-by-step annotations. Those annotations are important because it is one of the most obvious ways to differentiate LLM-generated code from human-written attacks if you have access to the payloads. There were breadcrumbs left in the other ATA attacks, too, but these AI-generated script artifacts are behavioral signals you can detect at runtime.
2. AI infrastructure has become the target
JADEPUFFER is just one example of a pattern the Sysdig TRT has been tracking across multiple campaigns. Another emerging thread is that AI infrastructure has deliberately become an attacker’s priority target, and the “why” comes down to what that infrastructure often holds.
A credential warehouse
In AI infrastructure, credentials are frequently stored in places they shouldn’t be, there are often connections to sensitive data, default passwords are regularly left unchanged, and access is sometimes left exposed to the internet. In other words, AI infrastructure is a veritable goldmine because it reveals the tools organizations are deploying to build AI applications.
Langflow, LMDeploy, Marimo, LiteLLM, PraisonAI, and similar frameworks are the connective tissue of modern AI development. They orchestrate model calls, broker credentials, touch cloud APIs, and sit adjacent to production data. They're also being deployed quickly, on internet-facing infrastructure, without the hardening that organizations have spent years building around the rest of their databases and APIs. Exploit one, and you may walk away with OpenAI API keys, Anthropic credentials, AWS access keys, cloud storage tokens, and database connection strings, all from the same environment. It’s not just a foothold anymore, and attackers know it.
JADEPUFFER demonstrated this, too. The Langflow instance was the door in, and the agent searched explicitly for high-value credentials and keys. The production MySQL server and Nacos configuration service that was targeted after were also loaded with credentials and data.
Stealing access to models
The Sysdig TRT coined the term LLMjacking in May 2024 to describe attackers using stolen cloud credentials to access hosted model APIs and siphon AI compute. Contemporary estimates found that LLMjacking could leave victims with bills up to $46,000 per day. By 2025, it had matured into an industrialized black market, brokering billions of stolen tokens through the sale of reverse-proxy infrastructure.
As organizations have begun running their own models locally, we’ve seen the attack surface shift again. Most recently, an attacker used a victim’s exposed, unauthenticated Ollama server as the reasoning engine to build an autonomous offensive tool. To that end, there were an estimated 175,000 Ollama instances publicly exposed in more than 130 countries earlier this year. The potential surface is staggering.
Arguably, if your AI stack isn’t in your asset inventory, it’s a blind spot. The risk of these threats reaching your organization can be drastically reduced if you know what AI infrastructure exists in your environment, and where. Step one is identifying the infrastructure with an AI bill of materials (AIBOM). From there, risk reduction is basic security hygiene: identity management, runtime detection, and reducing public exposure.
3. The clock has collapsed
The assumption embedded in most vulnerability management programs is still that there is time: time after disclosure, time to assess and prioritize, time to schedule a patch, and so on. That assumption is no longer valid. With AI adoption well-established across the board, applications are being built fast and broken faster. Time — more so now than ever — is of the essence.
Disclosure is the starting gun
The Sysdig TRT has spent the last several months documenting exploitation timelines. The pattern is consistent, and the numbers are alarming:
- PraisonAI authentication bypass, a multi-agent orchestration platform exploited in under 4 hours.
- Marimo RCE, a reactive Python notebook platform exploited in under 10 hours.
- LMDeploy SSRF, an LLM inference engine exploited in 12 hours.
- Langflow RCE, a visual framework for building agents and RAG pipelines compromised in 20 hours.
- LiteLLM SQL injection, an LLM gateway exploited in 36 hours.
The numbers above aren't even post-CVE exploitation timelines; several of these attacks began from a GitHub Security Advisory (GHSA), before a CVE was even assigned. Today, the disclosure is the starting gun because they explain proofs of concept, so attackers can use them to craft exploits in seconds with an LLM.
Once they’re in, the clock ticks faster
Once an attacker breaches a cloud environment, there is a new timescale challenge to deal with. The Sysdig TRT first established the 555 Benchmark for cloud detection and response in 2023 after concluding that the average cloud attack unfolded in 10 minutes or less, end to end. The Sysdig 555 Benchmark stands for 5 seconds to detect, 5 minutes to triage, and 5 minutes to respond — that’s all the time defenders have to thwart cloud threats.
Since then, with AI-driven and AI-assisted attacks, that figure holds true. In the marimo vulnerability mentioned above, for example, it only took the attacker three minutes to harvest credentials from the victim's environment. In another AI-assisted intrusion, it took 8 minutes for the attacker to obtain administrative privileges, after which they exfiltrated resource data and conducted an LLMjacking campaign.
The 555 Benchmark was designed to set a minimum operational tempo for security teams to keep pace with modern attacks. That timescale is now more important for organizations than ever, and teams running agentic detection and response capabilities are operating at the necessary speed to stay ahead.
4. Attackers are manipulating models
Attackers have also learned how to get AI models to do their “work” for them. This may come as no surprise, but the security industry at large anticipated evolution and implemented safety guardrails in their models. Nevertheless, attackers persist.
Jailbreaking models
In June 2026, the Sysdig TRT observed multiple threat actors wrapping malicious prompts in "capture the flag" (CTF) framing to bypass LLM safety filters. By framing their requests as authorized security exercises, attackers convinced legitimate models to generate working CVE exploits that these models would otherwise refuse to produce.
While this CTF jailbreaking method is an LLM security failure, it does leave obvious forensic traces in the exploit script the model outputs. The CVE number of the exploit requested by the attacker in the prompt bleeds directly into command headers, passwords, and IAM log entries. Those artifacts are a new, simple detection signal that defenders can and should be looking for.
Now, how long before threat actors discover how to falsify these artifacts and use them to mislead defenders? Once again, the clock is ticking…
Abliterated models
On the other hand, why bother with prompt manipulation when you can operate a model that has no guardrails? The Sysdig TRT's most recent LLMjacking finding, also explained above, was not only significant because the attacker stole access to a victim’s LLM to build an autonomous tool. The LLM was an “abliterated” Llama-3.3-70B model, which means it is a model version with the safety guardrails removed. The model had no restrictions and the operator had no cost.
Taken together, these two techniques represent attackers' recognition that AI models are a resource to be exploited, manipulated, or stolen depending on what’s available or convenient. Every self-hosted model endpoint has an attack surface, every AI API key is a target, and every model itself can potentially become a component in an attack chain one way or another for someone who can get to it.
What this means for defenders
While these four storylines are distinct, they can compound.
Picture this: An agentic threat actor exploits a pre-CVE flaw in an AI pipeline tool hours after disclosure, steals credentials that weren’t hardened, and runs the entire operation on stolen compute powering a guardrail-stripped model. The whole campaign can be completed in well under an hour, if not in minutes.
This is hardly a hypothetical chain. It could actually be a description of JADEPUFFER, but with the addition of the LLMjacking and manipulation tactics that the Sysdig TRT has documented. It’s not outside of the realm of possibility to assume that an LLM used for an attack like JADEPUFFER — or a similar ATA — could be abliterated and/or powered by stolen compute.
These attacks are different, but they’re also detectable. For now, LLM-generated code narrates itself, annotates its reasoning, and produces structured output in ways that human operators don't bother with.
JADEPUFFER's payloads included natural-language step rationale inside injected scripts. The VAPT framework's orchestrator prompt contained detailed documentation of the tool's own architecture. These aren't signatures to block — they're behavioral patterns to hunt for if you’re able to see the payloads of the ATAs. So while models may be a part of the attack surface, they also offer up a source of intelligence. Detections tuned to known signatures miss agents that write novel payloads on every run.
Similarly, vulnerability management that operates on patch cycles misses exploitation that begins within hours of disclosure. And security tooling that doesn't cover every nook and cranny and trust boundary of AI infrastructure misses the credential stores that make the rest of the kill chain possible.
Runtime visibility into what is actually executing, in real time, across workloads and AI infrastructure is the foundation. It's the control that operates at the speed and level of granularity that these attacks demand.
For the full technical research behind each of the findings referenced in this post and to keep up with our newest findings, visit sysdig.com/threat-research.