Reported AI actor 'JadePuffer' wipes Azure tenant resources

A threat actor described as "agentic" and dubbed JadePuffer compromised a Microsoft Azure tenant and deleted cloud-based storage, applications and databases, according to a report published by Dark Reading on 28 September 2026.

The report says the actor may have used exposed credentials to reach the affected resources. Exposed credentials are login secrets — keys, tokens or passwords — that end up somewhere an attacker can read them, such as a public code repository, a misconfigured storage bucket or a leaked configuration file. On that account, the entry point was not a flaw in Azure itself but a failure to keep valid credentials private.

The outcome described is destructive rather than extortive. Storage, applications and databases were deleted, according to the report. Destructive attacks on cloud tenants are among the worst outcomes for a victim organisation, because a single set of sufficiently privileged credentials can be enough to remove large amounts of data and infrastructure quickly, and recovery depends entirely on what backups exist outside the compromised tenant.

What makes the case notable, on Dark Reading's framing, is the label attached to the attacker. An "agentic threat actor" is one where an AI agent — software that plans and carries out multi-step tasks with limited human direction — does some or all of the work, rather than a person working through each step at a keyboard. The published report does not set out, in the material available, what evidence supports that characterisation, which model or tooling was involved, or how much of the intrusion was automated.

A good deal remains unconfirmed. The affected organisation has not been identified in the source. The date of the intrusion itself is not given; 28 September 2026 is the date of the report. There is no indication of how many resources were destroyed, whether any were recovered, or whether Microsoft has said anything about the incident. Nothing in the source attributes the activity to a named group, country or individual. Readers should treat the account as reported rather than confirmed, and the causal chain — exposed credentials leading to deletion — as the report's own qualified suggestion.

For defenders, the one actionable element in the account is mundane and predates AI agents entirely: credentials that should be secret were not. Whatever drove the hands on the keyboard, the door appears to have been left unlocked. Tenant-level logging, short-lived credentials, restrictions on which identities can delete resources at scale, and backups held outside the tenant are the standard controls that limit how much damage any single compromised identity can do — automated or otherwise.