JadePuffer lets an AI agent choose each step of a ransomware attack inside Azure tenants

Every stage of the chain is a call against the tenant's own APIs. As the post describes it, the agent enumerates the tenant, finds overprivileged identities and escalates ^[2]. That path has been open since Entra ID misconfigurations became common, the author argues ^[2]. Between those calls there used to be an operator at a dashboard deciding which subscription to pivot to next. In JadePuffer the agent makes that choice ^[3]. "If your tenant was vulnerable to this attack path via a human operator with a laptop and a checklist, it was vulnerable to this," Cor of Skyblue Soft wrote ^[4].

The operator was the slow part. A human tires, makes mistakes, hesitates and gets interrupted by OPSEC worries, and an autonomous loop does none of these, the post notes ^[5]. I think most detection pipelines were sized against those pauses, though no one wrote that down as a requirement. The post frames the human-run case as hours between initial access and impact, and says an autonomous decision loop might not leave that much ^[7].

Azure's own APIs narrow the gap further. "Destructive ransomware in cloud environments succeeds because deletion and role assignment APIs are fast and forgiving," Cor wrote ^[9]. An agent with a viable credential will hit those APIs at machine speed, per the post ^[10]. The race is then between a delete request and whatever reads the alert. The author's advice is to "assume your detection window just got shorter" and to weigh mean-time-to-detect against mean-time-to-destruction ^{[6] [7]}.

Most of the post's checklist limits blast radius: least privilege on service principals, no standing admin credentials where an automated recon step would find them, and tight conditional access ^[8]. Those controls cap what one stolen credential can reach, and they hold whether the caller is a person or a loop. The one detection item is aimed at the destructive stage: monitoring resource deletion events, not just login anomalies ^[8]. I'd put the first effort into identities that can assign roles or delete resources, because a permission the credential never held cannot be used at any speed. The author asks whether autonomous chains push teams back toward prevention-first architectures they abandoned as too restrictive to use ^[13].

The same design is showing up on the defending side. Many teams are adding tool-calling loops with autonomous decisions to internal ops tooling, and the post warns that an agent with broad API access and no human checkpoint cuts both ways ^[14].

The evidence here is thin. The post summarizes JadePuffer "per the reporting" without naming the outlet ^[17], and it does not include a measured time from access to deletion. Its compression claim depends on the decision loop being genuinely closed ^[5]. The post is marked as an AI-assisted draft, human-curated ^[16]. On Hacker News it drew zero points and zero comments ^[15].