agents used webmcp + 402 to make a ransom demand