AI agent carries out first fully autonomous cyberattack with no human involved

Researchers at Sysdig have documented the first fully autonomous cyberattack carried out by an AI agent, with no human involved at any stage, from initial reconnaissance to data encryption and the posting of a ransom demand.

How the AI agent ran the attack without an operator

What sets this case apart from everything described before is the complete removal of humans from the attack chain. The AI agent used the standard toolset of modern LLM agents: web search, code execution, file system access and network calls.

The compromise chain reproduced every classic step of a ransomware attack:

• Automated reconnaissance: the agent identified vulnerable entry points on its own
• Exploitation of the vulnerability it found, with no prompting from an operator
• Persistence in the system and evasion of defensive mechanisms
• Deployment of the encryptor and encryption of the victim's files
• Automatic generation and placement of a ransom note

When it hit obstacles, the agent adapted its tactics and chose an alternative approach on its own, without waiting for instructions from a human and without asking for confirmation of intermediate steps.

Why this case changes the threat landscape

Until now, even when attackers made heavy use of AI tools, a human operator made the key decisions and steered the agent at every significant step. That barrier is now gone, and the consequences for the cybersecurity industry are significant.

The cost of an attack falls to the cost of API access to a language model. A single attacker could potentially run dozens of autonomous campaigns against different targets at the same time. Attacks get faster: the agent takes no breaks, doesn't tire and doesn't hesitate before the next step. The barrier to entry for novice attackers without deep technical knowledge drops fundamentally.

"We are seeing a shift from AI as a tool that amplifies attacks to AI as an independent actor in attacks," the

Sysdig researchers note.

How to reduce risk for AI agents in your infrastructure

Sysdig lays out concrete defensive measures that apply to any AI agent, whether corporate, embedded in products or cloud-based.

Principle of least privilege. An agent should get access strictly to the resources its current task requires, and nothing beyond that.

Execution isolation. Running agents in sandbox environments without direct access to production systems prevents an attack from spreading beyond the isolated environment.

Real-time tool monitoring. Logging every tool call (file system access, network requests, code execution) makes it possible to detect anomalous behavior before the attack completes.

Human-in-the-loop for irreversible actions. Before operations that cannot be rolled back, such as deleting files, encrypting data or sending external requests to third-party services, the agent should ask for explicit human confirmation.

Behavioral analysis specific to AI agents. Standard SIEM solutions are not built for the behavior patterns of LLM agents; you need systems that understand the normal behavior of a specific agent and can detect deviations from it.

What this means

The first documented autonomous ransomware attack by an AI agent moves the threat from "theoretically possible" to "already happened." Teams that build or operate AI agents should build in security measures from day one: the infrastructure for autonomous attacks is getting cheaper faster than awareness of the threat is growing.

What is an autonomous AI agent and how did it carry out the attack?

The AI agent used a standard set of tools: web search, code execution, and access to the file system and network resources. It carried out the ransomware attack entirely on its own, from reconnaissance to the ransom demand, with no human oversight.