TL;DR
- what: Sysdig identified JADEPUFFER, which it believes is the first ransomware attack executed start to finish by an autonomous AI agent, entering through the Langflow RCE CVE-2025-3248.
- impact: The agent stole API keys and cloud credentials, pivoted to a production MySQL and Nacos server, encrypted 1,342 configurations, dropped the tables, and discarded the encryption key, making recovery impossible even if the ransom is paid.
- fix: Patch Langflow to 1.3.0 or later, take its code-execution endpoints off the internet, change the Nacos default signing key shipped since 2020, rotate any exposed credentials, and restrict outbound traffic from AI tooling hosts.
- who: Any organization running internet-exposed Langflow, Nacos, MinIO, or other AI/microservice infrastructure with unpatched CVEs, default credentials, or cloud keys sitting in environment variables.
Sysdig's Threat Research Team has published what it believes is the first ransomware operation run entirely by an AI agent. The operator, tracked as JADEPUFFER, used a large language model to handle every phase: initial access, credential theft, lateral movement, persistence, and finally encrypting and destroying a company's production database. No human appears to have touched a keyboard during the intrusion. Sysdig counted more than 600 separate, purposeful payloads across the operation, and in one instance the agent diagnosed a failed login and deployed a correct multi-step fix in 31 seconds.
The significance is not the tradecraft, which was mostly recycled. It is the economics. Ransomware has always required a skilled operator somewhere in the loop, either live at the keyboard or authoring the playbook the malware follows. If an agent can chain those steps unsupervised, the skill floor for running an attack drops to the cost of renting the model.
The entry point was a year-old, patched bug
JADEPUFFER got in through CVE-2025-3248, a missing-authentication flaw in Langflow, the open-source builder for AI apps and agent workflows. The bug lets anyone who can reach the server execute arbitrary Python with no login. It was fixed in Langflow 1.3.0 and added to CISA's Known Exploited Vulnerabilities catalog in May 2025, over a year before this attack. Langflow servers are attractive precisely because of what they do: they routinely sit internet-exposed and hold API keys and cloud credentials for every service they orchestrate. This is not even the only Langflow flaw currently being exploited in the wild.
Once inside, the agent mapped the host and swept it for secrets: API keys for OpenAI, Anthropic, DeepSeek, and Gemini; cloud credentials for AWS, Google, Azure, Alibaba, and Tencent; crypto wallet keys; and database logins. It raided a MinIO storage server that was still running the factory-default minioadmin:minioadmin login. For persistence, it planted a scheduled task beaconing to attacker infrastructure every 30 minutes.
The pivot: root MySQL access and a 2021 Nacos bypass
The real target was a separate internet-facing server running MySQL and Alibaba's Nacos, a configuration and service-discovery component common in microservice stacks. The agent logged into the database as root; Sysdig never determined where those root credentials came from. It then took over Nacos using CVE-2021-29441, a five-year-old authentication bypass, combined with a default JWT signing key that Nacos has shipped unchanged since 2020, and created its own admin account.
The agent encrypted all 1,342 Nacos configurations, dropped the original tables, and left a ransom note demanding Bitcoin with a Proton Mail contact. Then it went further, deleting entire databases and leaving a comment in its own code claiming the data had been exfiltrated. Sysdig found no evidence any data actually left the environment. That claim was the model talking, not a verified fact.
⚠️ There is no decryption key. Do not pay. — The agent generated a random encryption key, printed it to the console once, and never saved or transmitted it. Recovery is impossible regardless of payment. The note claims AES-256; the tool actually defaults to AES-128, but the outcome is identical: the data is gone. Backups are the only recovery path for this class of attack.
How Sysdig knows a model was driving
The strongest evidence was the code itself. The payloads were saturated with plain-English comments explaining why each step was taken, the kind of running commentary a human intruder never writes but an LLM produces by default. The agent also corrected its own errors at machine speed, diagnosing root causes rather than blindly retrying, with the 31-second failed-login recovery as the standout example.
One artifact remains unexplained. The Bitcoin address in the ransom note is the exact sample address used throughout Bitcoin's own developer documentation, which saturates LLM training data. It is also a real, active wallet with a long payment history. Sysdig cannot tell whether the model hallucinated a familiar address from memory or the operator deliberately chose a real wallet matching the famous example. Either way, it echoes the fabricated credentials Anthropic observed in the largely autonomous Chinese state-linked campaign it disclosed in November 2025.
This is a trendline, not a one-off
The past year traced a clear arc. August 2025 brought PromptLock, billed as the first AI-powered ransomware but later revealed as an NYU lab prototype. The same month, Anthropic reported a real extortion campaign using Claude Code against at least 17 organizations with demands topping $500,000, though a human still steered it. November 2025 brought the firstlargely autonomous cyberattack, a Chinese state-linked espionage effort. JADEPUFFER is the point where full automation reaches commodity ransomware.
Why this shifts the patch calculus — Agents make spraying the entire back catalogue of known CVEs nearly free, so neglected servers get more exposed, not less. Because attackers can weaponize a fresh advisory in hours, Sysdig argues runtime behavioral detection now matters more than winning the race to patch.
What defenders should do
The mitigations are unglamorous and familiar, which is the point: this attack succeeded entirely on neglected basics. The agent used no novel exploit, only unpatched software and default credentials nobody had rotated.
- Patch Langflow to 1.3.0 or later and never expose its code-execution endpoints to the internet.
- Keep cloud keys and provider credentials out of AI tooling environments; store secrets in a dedicated manager, away from anything web-reachable.
- Harden Nacos: change the default signing key, keep it off the public internet, and never let it connect to its database as root.
- Never expose a database admin account to the internet, and rotate the default MinIO minioadmin login and any similar factory credentials.
- Lock down outbound traffic so a compromised host cannot beacon home; the JADEPUFFER persistence task called out every 30 minutes.
- Prioritize runtime behavioral detection, since attackers can now weaponize new advisories faster than most teams can patch.
Sysdig's published indicators for this operation include the entry point CVE-2025-3248 (Langflow unauthenticated RCE) and command-and-control infrastructure at 45.131.66.x. Hunt for unexpected scheduled tasks with regular short-interval outbound beacons, new Nacos admin accounts, and root-level database logins from unfamiliar sources.
Originally published on RedEye Threat Intelligence.
Top comments (0)