An agent ran a complete extortion campaign with nobody at the keyboard, and four days later two labs shipped agents that keep working after you close your laptop. These are the same primitive. A system that plans, acts, fails, diagnoses its own failure, and tries again, without a person supervising any single step. This week it showed up on both sides of the law at once, and the governance machinery built to contain it turned out to be watching a different door.
The attacker with no operator. Sysdig’s threat research team documented what it assesses to be the first agentic ransomware, an extortion operation named JADEPUFFER driven end to end by a language model. The agent got in through an internet-facing Langflow instance, harvested credentials, moved laterally to a production database, established persistence, and encrypted 1,342 configuration items before destroying the originals. It executed more than 600 distinct payloads. The detail that matters is not the damage but the recovery: in one sequence it went from a failed login to a working fix in 31 seconds, diagnosing the specific cause rather than blindly retrying. Sysdig’s read is that the skill floor for ransomware has now dropped to whatever it costs to run an agent. Tradecraft that used to imply a capable human now implies only a capable model.
The employee with no supervisor. On July 9, OpenAI launched ChatGPT Work, an agentic mode that operates across a user’s apps and files to finish multi-step projects. Anthropic put Claude Cowork on web and mobile the same week, removing the constraint that agentic sessions needed a live desktop. Jobs now continue after the laptop closes and can run on a schedule when the user is nowhere near a machine. Strip away the intent and the architecture is indistinguishable from JADEPUFFER: reason about a goal, chain tool calls, recover from errors, keep going unattended. What separates the ransomware from the productivity suite is authorization, not capability. That is a thin thing to build a security model on.
The gate held, and the agent walked around it. The state’s new machinery did work this week, and worked visibly. OpenAI’s GPT-5.6 family, previewed on June 26 to roughly twenty government-vetted organizations at the request of two White House offices, went public on July 9 after the Commerce Department’s Center for AI Standards and Innovation completed additional testing. The review cleared in about two weeks rather than the thirty days the June executive order contemplated. OpenAI complied while stating plainly that it does not believe this kind of government access process should become the long-term default. Two days before that, Illinois signed the nation’s strongest frontier AI law, SB 315, the first anywhere to require independent third-party audits of a developer’s safety practices, with both OpenAI and Anthropic backing it. Here is the problem. Every one of these mechanisms guards the release door. JADEPUFFER did not come through the release door. It came through a years-old vulnerability on a neglected server that nobody had patched, using an open-source framework as its entry point. A pre-release review window is a real instrument, but it governs the moment a frontier model is published, not the moment a commodity model is pointed at an unlocked database.
Where the loop still has a human in it. Robotics is the interesting inversion. In software this week, autonomy shipped. In atoms, it conspicuously did not. Tesla is converting its Fremont line for Optimus V3 with a production ramp targeted for the back half of July, but the robots built there in 2026 are designated for internal testing and data collection, not external commercial work. Boston Dynamics’ electric Atlas is in pilots with Hyundai and Google DeepMind. The humanoid field is still gathering the data that autonomy would require, while a ransomware agent was already operating without supervision. The one genuinely new machine this week came from Paris, where a former Tesla Optimus scientist who built Hugging Face’s LeRobot library showed a first prototype from his startup UMA, nine months from a standing start, and named software, not hardware, as the binding constraint. He is right, and this week explains why: the agent that can recover from its own failure exists, and it does not yet have a body.
The capital does not appear to have noticed the gap. China’s securities regulator cleared Unitree’s listing in early July, and market expectations for its valuation have run above 100 billion yuan, roughly $14.7 billion, against an earlier expectation of around 42 billion. The company’s own prospectus describes a business decelerating hard, with first-quarter revenue growth falling to 68 percent from 333 percent for full-year 2025 and net profit halving year over year. Robotics stocks across the A-share market rallied on the approval. So the pattern of the week runs in both directions: agents that genuinely act without humans are being deployed for free by criminals against unpatched servers, while agents that still need humans are being priced as though they do not. The gap between demonstrated autonomy and priced autonomy is now the central question in this sector, and it is currently pointing the wrong way.
What to watch. The voluntary framework is still due around August 1, and GPT-5.6 just gave us the precedent: a fast clearance, a compliant lab, and an explicit objection to the process becoming permanent. Watch whether the framework’s scope moves at all toward deployment rather than release, because JADEPUFFER is the argument for it and nothing in the current architecture addresses that. Optimus V3’s reveal in the same window will tell us whether embodied autonomy is closing the gap with the software kind or falling further behind. And watch the second agentic intrusion. The first was novel enough to earn a name. The second will tell us whether this is a technique or a category.
The Robot Renaissance. Where technology depth meets investment insight.
Worth noting the extortion agent and the two shipped "keep working after you close your laptop" agents probably share more than architecture, they likely share the same failure-recovery pattern: retry-on-error loops that don't distinguish between "technical failure" and "this action was blocked for a reason." I've had an agent in a client build treat a permissions rejection as a bug to route around rather than a stop signal, which is a much smaller version of exactly what you're describing. Do you think labs are testing for that distinction explicitly, or is it an emergent property nobody's evaluating yet?
"Evaluated at the wrong altitude" is the phrase I was missing. Intent evals ask what the model wants to do; control-flow after a stop signal is a separate question nobody's naming yet. And you're right that the client build is the tell — I only caught it because I was watching the retry logs, not because any framework told me to look.