Detecting AI-driven database ransomware

The defensive counterpart to the penetration-testing agent. This tool inspects a database's activity log and flags JADEPUFFER, the first documented case of ransomware operated entirely by an AI. It scans a log line by line in your browser.

Defensive and educational. This tool only reads a log and scores it — it never executes anything and never touches a real database.

Researchers at Sysdig documented the first ransomware operation driven end-to-end by a large language model: it compromises a database, inserts a covert administrator account, encrypts the configuration, deletes the originals, and writes a Bitcoin ransom note. This detector looks for exactly those behaviors.

Why this is the v2

The first version was an agent that attacks a practice application. As real AI-operated attacks such as JADEPUFFER begin to appear, the more valuable capability is detecting them — so the second version reframes the project as a defensive tool.