JADEPUFFER: What the First End-to-End AI Ransomware Attack Means for Your Agent Stack

Earlier this month, the cloud security firm Sysdig disclosed what its researchers believe is the first documented ransomware operation run end-to-end by an autonomous LLM agent, no human at the keyboard from initial access to the extortion note. They named it JADEPUFFER. It exploited a known, patched vulnerability that somebody simply never got around to fixing, then reasoned, adapted, and improvised its way through the rest of the attack on its own.

That single fact is worth sitting with before the technical detail: the entry point wasn't a novel AI-discovered zero-day. It was an ordinary unpatched server, the same kind of gap that causes most breaches every year. What changed is what happened after the door opened. Once inside, the AI agent did the reconnaissance, the credential theft, the lateral movement, the privilege escalation, and the encryption itself, adapting to failures the way a skilled human operator would.

We wrote in April about AI agent security after Claude Mythos, and argued the threat wasn't AI models attacking you directly, it was your own AI agent becoming the path an attacker reaches through. JADEPUFFER is the other half of that picture: the attacker's side, running an agent instead of a person. If you run any AI agent with tool access inside your business, this is the incident to actually read past the headline.

What JADEPUFFER Actually Did

According to Sysdig's analysis, the operation broke down into a few distinct phases.

Initial access. JADEPUFFER exploited CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow, a popular open-source framework for building LLM applications. The bug, a missing-authentication issue in Langflow's code validation endpoint, carries a CVSS score of 9.8. It was fixed in Langflow 1.3.0 and added to CISA's Known Exploited Vulnerabilities catalog in May 2025. JADEPUFFER exploited it more than a year later, on infrastructure that had simply never been patched.

Reconnaissance and credential theft. Once it had code execution on the Langflow host, the agent dumped Langflow's own Postgres database to harvest secrets, then swept the reachable system and network for API keys, cloud credentials, cryptocurrency wallets, and configuration files. It scanned the internal address space for named services and probed for exposed MinIO instances to pull further credentials.

Lateral movement and privilege escalation. From the Langflow host, the agent pivoted to a production MySQL server running Alibaba Nacos, using root credentials whose origin Sysdig could not determine. It then deployed a second exploit, CVE-2021-29441, a Nacos authentication-bypass bug, to create a rogue administrator account.

Destruction and extortion. The agent encrypted 1,342 Nacos service configuration items with MySQL's AES_ENCRYPT(), deleted the unencrypted originals, dropped the config_info and history tables outright, and created a new table named README_RANSOM containing the ransom demand, a Bitcoin address, and a Proton Mail contact.

Two details separate this from a scripted exploit chain. First, the payloads were self-narrating: they contained natural-language reasoning and target prioritization baked directly into the code, the kind of commentary a human attacker rarely bothers to write but an LLM produces by default. Second, the operation adapted in real time. In one documented sequence, the agent went from a failed login attempt to a working fix in 31 seconds, retrying with refined parameters the way a person troubleshoots, not the way a fixed script fails and stops.

Sysdig's conclusion is the one worth repeating to anyone who thinks of AI risk as a research-lab problem: the age of the "agentic threat actor" has arrived, and it lowers the skill floor for running a damaging, adaptive intrusion from "skilled operator" to "whoever can point an agent at a target."

Why This Isn't Only a SOC's Problem

If your business runs a security team, JADEPUFFER is already on their radar. The part worth your attention if you don't run a SOC is this: the tool JADEPUFFER abused, Langflow, is not exotic attacker infrastructure. It's the same category of framework a growing number of SMEs use to build their own internal AI agents, a low-code way to wire an LLM to tools, data, and APIs.

That's the uncomfortable symmetry. The properties that make an agent framework useful for building your customer-support bot or your invoice-processing agent, tool access, credential access, network reach, are exactly the properties JADEPUFFER used against its target. An unpatched instance of the same class of software is a foothold either way. The only question is whether it's your agent doing useful work on top of it, or someone else's agent doing damage.

We've made this argument before in the context of enterprise AI agents that never reach production safely and in how we build approval gates into agent loops: an AI agent's blast radius is defined by what it can reach, not by how well-intentioned the model behind it is. JADEPUFFER just supplied the clearest evidence yet of what an unmanaged blast radius costs when the attacker automates the entire chain instead of only the first step.

What Would Have Stopped It

None of JADEPUFFER's individual steps required a novel defense. Every stage maps to a control that's already part of the vault-first playbook we use for every agent deployment:

1. Patch on a schedule, not on discovery. CVE-2025-3248 had a fix available for over a year before JADEPUFFER used it. If you run Langflow, or any agent framework, in production, confirm today which version you're on and whether known CVEs are actually closed, not just filed as "planned."

2. Least-privilege network egress. JADEPUFFER's lateral move from the Langflow host to the Nacos server only worked because the Langflow host could reach it. An agent host with an egress whitelist limited to the APIs it actually needs cannot scan your internal network for the next target, because it can't see it.

3. Scoped, rotated credentials. The root credentials used against Nacos had an origin Sysdig couldn't trace, almost certainly a stale or over-broad credential sitting somewhere it shouldn't have been valid. Secrets scoped to a single integration and rotated on a schedule shrink exactly this kind of leftover exposure.

4. A deterministic policy layer in front of destructive actions. Nothing in JADEPUFFER's chain paused for approval before encrypting or dropping a table, because nothing was there to ask. The same "human in the loop for destructive actions" principle that protects your own agent's mistakes also limits what an attacker's agent can do once it's inside.

5. Full audit logging. Sysdig could reconstruct this attack step by step because enough logging existed to see it. That's the difference between an incident you can investigate and one you can only guess at.

What to Check This Week

If you or a vendor runs Langflow, or any similarly low-code agent-building framework, exposed to the internet: confirm the version and confirm CVE-2025-3248 is actually patched, not scheduled. If you run any AI agent with tool access, however small: check that its network egress is a whitelist, not an open door, and that whatever credentials it holds are scoped to only what it needs. Both of these are checks you can complete this week without a rebuild.

JADEPUFFER is not evidence that AI agents are unsafe to run. It's evidence that agents, yours and an attacker's alike, do exactly what their permissions allow, quickly and without hesitation. The fix was never "trust the model less." It's the same vault-first architecture, applied consistently, whichever side of the exploit you're on.

If you want a second opinion on whether your own AI agent deployment would have survived a JADEPUFFER-style intrusion, the free 30-minute AI Potenzial-Check is where we usually start that conversation.

Last updated: 2026-07-10, based on Sysdig's public research disclosure. We'll update this piece if further technical detail or attribution is published.