When the attacker is a machine
Two research teams just published the primary evidence. Neither case happened at a bank. Both change the threat model for one.
In early July, a production database somewhere on the internet was taken apart by something that was not a person.
It found its way in, stole credentials, moved sideways to the server it actually wanted, encrypted 1,342 configuration files, deleted the originals, and left a ransom note — and it did all of it by narrating its own reasoning in plain English inside the code, the way no human operator ever bothers to. Security researchers who reconstructed the attack concluded the operator was a large language model running with almost no human hand on the wheel.
The victim wasn't a financial institution. The point of this brief is why that is cold comfort, and what a Chief Risk Officer should actually do about it on Monday morning.
"Tradecraft that once implied a capable human now implies a capable model."
That line, from the Sysdig team that documented the attack, is the whole story in nine words. The skill floor for a serious intrusion just dropped to whatever it costs to rent a competent model. Below are the four things worth your attention this month — two that have happened, two that are quietly building — each labelled by how much we actually know.
Your AI subscription is now an attack asset
Cisco's Talos team got a rare look inside real criminal operations: attackers left prompt logs from their AI coding assistants exposed online through sloppy security. The logs show AI being used to write malware, build fraud tooling, and hunt vulnerabilities — the expected stuff.
The detail that should stop a CRO is quieter and almost everyone missed it: some attackers were running on stolen enterprise AI accounts and API tokens instead of paying for their own compute.
Read that as a risk officer, not a technologist. Your organisation's AI assistant seats and API keys are not just a data-governance question. They are billable capacity — capacity an intruder can spend, in your name, against someone else, while your finance team sees a slightly larger cloud bill. Most institutions monitor privileged admin credentials closely and monitor AI consumption not at all.
The practical posture: prepare for AI-assisted attacks to place increasing pressure on the speed of your fraud controls, patching, third-party monitoring, and incident escalation — not because a specific attack is coming for you, but because the tempo of the whole category is compressing.
Talos also found the models' own safety guardrails barely mattered. No clever hacking required — attackers simply claimed they owned the target, or said it was a security exercise, and the model complied. No proof was ever asked for. Which means any control story that rests on "the vendor's AI will refuse" is resting on nothing you could show a supervisor.
Ask in your next risk meeting
- Who owns the lifecycle of our AI API tokens — and would we notice one being used off-hours?
- Does anomalous AI consumption trip the same alarms as a compromised admin login?
The ransomware that ran itself
This is the attack from the opening. Sysdig named it JADEPUFFER and assesses it to be the first documented ransomware operation where a language model handled the entire technical chain itself. The mechanics matter more than the milestone:
- It got in through a flaw in Langflow — an open-source tool for building AI apps, the kind of thing a team spins up for a pilot and leaves exposed, often holding live cloud credentials.
- It pivoted to the real target using a database vulnerability first disclosed in 2021. Five years old.
- The encryption key was generated randomly and never saved. Paying the ransom would not have recovered the data.
Three takeaways for a financial institution, none of which is "AI ransomware is here":
Your AI pilots are production infrastructure. The way in was an experimental AI framework nobody was watching. If your teams are standing up AI tools, are those environments inventoried and governed like production, or treated as sandboxes?
Machine speed industrialises old neglect. The attacker didn't need a novel exploit. It needed a five-year-old unpatched flaw and the patience to try — and patience is free when the operator is software. This is as much a patch-hygiene finding as an AI one.
Your incident response is calibrated to human tempo. This operation diagnosed and recovered from its own failures in seconds. Playbooks built around human attacker speed are timing against the wrong clock.
The part most coverage will get wrong
The attack's code claimed it had copied the data out before destroying it. But Sysdig could not independently confirm that, and said so plainly — the claim came from the attacker's own narration, not from evidence the researchers could verify.
We flag it because that distinction is the difference between a data-loss event and a breach-notification event — and it's exactly the kind of nuance that disappears when a story gets retold. Confirmed destruction: treat as fact. Asserted theft: treat as unconfirmed. We won't collapse the two for you, and we'll tell you when we can't.
The bugs that never announced themselves
In two months, an autonomous system called NOVA analysed 3,915 open-source projects and found 14,090 confirmed vulnerabilities — 99.4% of them previously unreported, and 40% rated high or critical.
The headline number is the least interesting part. Machines have been finding bugs in bulk for a decade. What changed is the kind of bug: 92% of the findings were logic and authorisation flaws — broken access control, path traversal, code injection, server-side request forgery. These are the classes that never crash anything, never trip automated tooling, and have always required a human reading the code carefully. That work is now being done at scale by something that doesn't get tired.
The supply-chain slice is where it touches you directly: 1,280 flaws in dependency packages, producing 4,141 downstream exposures — and 2,776 of those exposure paths were confirmed with working proof-of-concept exploits. Not theoretical inheritance. Demonstrated.
Why we trust this one
Unit 42 checked its own results against the public record afterwards. Only 85 findings matched something already known — and most of those had been published two to eight weeks after NOVA found them. A vendor that publishes the test which could have embarrassed it is a vendor worth reading. We note it is still their system, their data, and their commercial interest.
What it means for you: your institution runs on open-source components you mostly reach through vendors you don't control. If flaws of this class are now discoverable at machine speed, the interval between a vulnerability existing and being weaponised compresses — and the value of knowing your actual dependency tree, with named remediation owners, goes up sharply.
The surface is expanding before anything breaks
In the last few weeks: BestEx Research announced an AI interface for institutional trading analytics; Scotiabank announced AI knowledge agents for its employees. These are announcements, not incidents, and we're careful to log them as such.
Their value is cumulative. Agentic systems are entering analysis, execution, and internal-information workflows at serious institutions — and the only moment to build governance is before something goes wrong, not in the post-mortem. The control surface is widening on a calm day. That's the day to map it.
A mismatch of tempo
Put the four together and they describe two sides of the same gap. On one side, attacking is getting cheaper, faster, and less skilled — old flaws exploited at machine speed, safety controls folding to a polite lie, stolen AI credentials funding the whole thing. On the other, institutions are handing agentic systems real access to information and decisions.
Nothing here shows those two lines crossing inside a bank. That is precisely why it's worth reading now, while the response is still cheap and mostly unglamorous: named ownership for every AI-enabled workflow, least-privilege access to tools and data, AI consumption watched like privileged credentials, AI pilots inventoried as production, vendor dependencies mapped with a way out defined, and escalation paths tested against machine speed rather than human speed.
None of that is exotic. All of it is easier to build on the calm day than the incident day.
Method & limitations
This brief draws on a bounded 60-source intelligence run. Primary sources were retrieved and read for all three findings. Finding 03 rests on vendor-reported research whose methodology and self-check are disclosed, labelled accordingly. Deployment Watch records announcements only. No finding here asserts an incident at a named financial institution. Where a source separates what it observed from what it was told, we preserve that line rather than collapse it. Corrections are logged publicly at agentrisk.org/corrections — if anything here is wrong, tell us and it will be fixed on the record.