JADEPUFFER: The First Ransomware Attack Run Entirely by an AI Agent

Six Hundred Payloads, Zero Human Keystrokes

In late June 2026, an attacker Sysdig calls JadePuffer broke into an internet-exposed instance of Langflow, an open-source framework for building LLM-powered application workflows, and let a large language model run the rest of the operation on its own. According to Sysdig’s technical writeup, the agent performed reconnaissance, harvested cloud and database credentials, moved laterally to a production server, exploited a second unrelated vulnerability, and encrypted more than a thousand configuration records — all without a human operator typing commands during execution.

The entry point was CVE-2025-3248, a missing-authentication flaw in Langflow’s code validation endpoint that lets an unauthenticated attacker execute arbitrary Python on the host. The bug carries a CVSS score of 9.8, was patched in Langflow 1.3.0, and was added to CISA’s Known Exploited Vulnerabilities catalog in May 2025 — more than a year before JadePuffer used it. The gap between patch availability and this attack is itself part of the story: an exposed, unpatched Langflow instance was still sitting on the public internet in mid-2026.

Once inside, the agent extracted API keys for OpenAI, Anthropic, DeepSeek, and Gemini, alongside cloud credentials for AWS, Azure, Google Cloud, Alibaba Cloud, and Tencent Cloud, according to The Hacker News’ reporting on the incident. It then installed a persistence mechanism — a scheduled cron job pinging the attacker’s server every 30 minutes — before pivoting toward the real target: a production server running a MySQL database and an Alibaba Nacos configuration-management service.

How Sysdig Reconstructed an AI Agent’s Kill Chain

What convinced Sysdig this was agentic rather than scripted is the texture of the payloads themselves. Researchers found the decoded commands “saturated with natural-language commentary explaining why each action is taken” — the kind of running self-narration a human operator never bothers to write into a shell command, but which a language model produces by default as part of its reasoning process, as Sysdig’s blog post details.

The clearest evidence of live, autonomous decision-making came from error recovery. When one of the agent’s login attempts against the Nacos service failed, it diagnosed the root cause — a subprocess PATH issue — and shipped a corrected, multi-step payload switching from subprocess calls to direct library imports in just 31 seconds, according to both Sysdig and CyberScoop’s coverage. It adapted again when a response arrived in an unexpected XML format, and again when a database write failed on a foreign-key constraint, resolving each with a targeted fix rather than a generic retry.

For the second-stage compromise, JadePuffer’s agent exploited CVE-2021-29441, an authentication-bypass flaw in Alibaba Nacos, then forged JSON Web Tokens using a default signing key Nacos has shipped unchanged since 2020. From there it encrypted 1,342 Nacos service configuration items using AES-128-ECB, dropped customer-data and user-database schemas, and left a ransom note. The encryption key itself was generated on the fly from two random UUIDs and never saved or transmitted anywhere — meaning, as Sysdig put it, “there is no key to hand over,” so victims could not recover their data even if they paid. Michael Clark, Sysdig’s senior director of threat research, summarized the shift bluntly: “the skill floor for running a full ransomware operation just dropped to whatever it costs to run an agent,” per CyberScoop’s interview with Clark.

Sysdig is careful to note the limits of the autonomy: a human still had to provision infrastructure, select the victim, and point the agent at a target before execution began. But once the operation was live, no keyboard input was required across reconnaissance, exploitation, lateral movement, or destruction — over 600 distinct payloads executed in sequence, per SecurityWeek’s account of the attack chain.

What Enterprise Security Teams Should Do About It

1. Treat exposed AI-orchestration frameworks as production attack surface, not developer sandboxes

Langflow, along with comparable tools like n8n and Flowise, is routinely deployed by data science and automation teams outside normal change-management review, often with default configurations and no authentication in front of admin endpoints. Sysdig’s own guidance names “exposed application servers, unhardened configuration stores, and internet-facing database admin accounts” as the first surfaces agentic attackers will probe. Inventory every LLM-orchestration tool running in your environment this quarter, confirm it sits behind authentication and a private network segment, and patch to the version that closes known CVEs — Langflow 1.3.0 closes CVE-2025-3248 specifically. Don’t assume a tool used for prototyping is exempt from the same hardening checklist as a customer-facing API.

2. Rotate and scope credentials on the assumption that one exposed host means all reachable secrets are compromised

JadePuffer harvested API keys and multi-cloud credentials from a single Langflow box and used them to pivot laterally within minutes. Config files, environment variables, and .env artifacts sitting next to an exposed service are the first thing an agent reads. Move to short-lived, scoped credentials (via a secrets manager, not flat files) and set automated rotation triggers on any host that has ever been internet-facing without authentication in front of it. A credential that never expires is a standing invitation regardless of who — or what — finds it first.

3. Assume default signing keys and default credentials will be tried within minutes of compromise, not months

The second-stage Nacos exploit succeeded because the service still used its factory-default JWT signing key, unchanged since 2020, and MinIO buckets were reachable with default credentials. This is not a novel vulnerability class — it is a housekeeping failure that agentic tooling now exploits at machine speed. Run a default-credential and default-key audit across every internal service (config stores, message queues, admin consoles) this month, not during the next scheduled security review.

4. Build detection around behavior, not signatures, because agent-generated payloads don’t match known malware families

JadePuffer’s payloads were novel, self-narrating, and adaptive — they will not match a signature database built from prior ransomware campaigns. Detection needs to shift toward behavioral indicators: unusual cron job creation, rapid sequential authentication failures followed by immediate self-correction, bulk credential-file reads, and off-hours mass encryption or schema-drop activity. Security teams that rely primarily on known-IOC matching will miss the next JadePuffer-style intrusion until the damage is already done.

The Bigger Picture

JadePuffer is not remarkable because the exploited vulnerabilities were new — CVE-2025-3248 had a public patch for over a year, and the Nacos default-key issue has been documented since 2020. What changed is the labor economics of running the attack. Sysdig’s Clark frames it as closing “loops that used to require a skilled human,” and that framing matters more than the specific victim or ransom amount, which Sysdig has not disclosed. An attacker no longer needs deep operational security tradecraft to chain a public RCE, harvest credentials, pivot across services, and execute irreversible destruction — they need access to a capable model and the patience to point it at an exposed target.

Security researchers who reviewed the disclosure, including Heath Renfrow as cited by Infosecurity Magazine, warn that agent-driven attacks compress what used to take hours of skilled human effort into minutes, pressuring every phase of incident response simultaneously. Sysdig itself expects campaign volume to grow as agentic tooling matures and becomes cheaper to run. For defenders, JadePuffer is best read as a preview: the vulnerability classes are familiar, but the speed and scale at which they can now be chained together are not.

Frequently Asked Questions

Sources & Further Reading

• JADEPUFFER: Agentic Ransomware for Automated Database Extortion — Sysdig
• AI Agent Exploits Langflow RCE to Launch Fully Autonomous Ransomware Attack — The Hacker News
• Sysdig Documents First Fully Agentic Ransomware Attack — CyberScoop
• Agentic AI Used to Conduct Ransomware Attack via Langflow — SecurityWeek
• Researchers Uncover First Fully Agentic Ransomware Attack — Infosecurity Magazine