For months I have been repeating the same thing in every Assessment I run: a granted permission is not proof that the behavior behind it is legitimate. An app with access to the camera, the microphone, the location, can hold that access in a completely valid way and still be doing something the user never actually authorized. That is the finding behind everything I do: first we see, then we decide. Never the other way around.
On July 1, Sysdig documented JadePuffer, the first documented case of ransomware operated end to end by an AI agent. It got in by exploiting an unauthenticated remote code execution flaw in Langflow (CVE-2025-3248). But what happened next is what made me stop and think: once inside, the agent collected credentials from the server itself (AI provider keys, cloud credentials and database credentials), connected to MySQL with root access (Sysdig could not determine where that credential came from), and went after Nacos through several routes at once, including an authentication flaw known since 2021 and a token forged with a default signing key that has been public since 2020. It left persistence behind with a scheduled task and ended up encrypting 1,342 configuration items with a key it never saved or transmitted, so the victim could not recover them even by paying.
Almost none of that movement required ingenuity: it was credentials that were already there and default settings nobody had changed, used at machine speed. The agent even corrected itself after a failed login in 31 seconds and left natural-language comments explaining its reasoning inside the payload.
This is not a technical curiosity. It is the confirmation, at enterprise infrastructure scale, of something I already knew as a security professional at the scale of a phone: valid authentication says nothing about whether what follows is legitimate. What changes is who decides to move (before a human attacker, now an autonomous agent), but the principle you have to apply to evaluate it does not change: verify the real behavior, do not trust that granted access implies correct intent.
If this is true for a personal phone, it is even more true for a company's infrastructure, where valid credentials move constantly between systems and nobody is checking whether that movement makes sense.
Want to know if your infrastructure has the same kind of exposure? Schedule a technical conversation with Directsales PTY.