JadePuffer: The First AI-Run Ransomware Attack

An AI agent broke into a server, stole credentials, moved across a network, encrypted a production database, and left a ransom note. Nobody was at the keyboard while it happened. Security researchers at Sysdig gave it a name: JadePuffer — the first documented ransomware operation run start to finish by a large language model.

Quick Facts

Entry point: CVE-2025-3248, an unauthenticated RCE flaw in Langflow
Payloads executed: 600+, run autonomously in sequence
Records encrypted: 1,342 Nacos configuration items
Time to self-repair a failed login: 31 seconds
Human involvement during execution: none

The Attack, In Plain Terms

The agent's first move was exploiting an already-known vulnerability in Langflow, an open-source tool developers use to build AI applications. From there, it dumped a database, hunted for credentials, and enumerated cloud storage connected to the server.

It then pivoted to a separate production server running MySQL and Alibaba's Nacos configuration service, using root credentials whose source the researchers couldn't trace back. It encrypted the configuration data, deleted the originals, and dropped a ransom table with a bitcoin address and a contact email.

None of this required new hacking techniques. Every individual step — credential dumping, lateral movement, config enumeration — is old news to anyone in security. What's new is that a model chained all of it together, on its own, without a human deciding the next move.

The 31 Seconds That Changed the Threat Model

Here's the detail that should actually keep you up at night. The agent tried a login. It failed. A human operator would stop, read the error, maybe ask a teammate, maybe rewrite a script. This agent read the failure, rewrote its own broken code, and logged in successfully — in 31 seconds.

It did the same thing later when a MinIO storage request returned XML instead of the JSON it expected. Instead of crashing, it adjusted its parsing logic on the next attempt and kept going.

That last row is the actual story. It's not that the AI is a criminal mastermind. It's that the skill floor for running a damaging attack just dropped to near zero.

This Was Not a Zero-Day. It Was Neglect

CVE-2025-3248 was patched back in April 2025. CISA flagged active exploitation the following month. And yet, over a year later, exposed and unpatched Langflow instances were still sitting on the public internet with live cloud credentials next to them.

This is the part founders skip past because it's less exciting than "AI ransomware." The vulnerability wasn't the hard part to fix. Somebody spun up a tool, exposed it, and never went back.

If you're self-hosting AI orchestration tools instead of renting managed infrastructure, the tradeoff only works if you actually maintain what you host. I wrote about doing this properly with Coolify on your own VPS in this guide — the cost savings are real, but only if patching and access control aren't an afterthought.

What This Means If You're Shipping an AI-Powered SaaS

Every founder bolting AI features onto a product right now is, by definition, running more orchestration tooling than they were a year ago. That's more surface area, not less.

A few things worth checking this week, not "eventually":

Self-audit checklist — run this against your own stack

1. Is your AI orchestration tool (Langflow, similar frameworks)
   reachable from the public internet? It shouldn't be.

2. Are your provider API keys (OpenAI, Anthropic, etc.) stored
   in the same environment as your orchestration server?
   Separate them.

3. Is the framework patched to the latest stable release?
   Check your version against known CVEs.

4. Is access restricted to a VPN or IP allowlist instead of
   open to the world?
   None of this is exotic advice. It's the same hygiene that's mattered for a decade — patch cadence, credential separation, least privilege. What's changed is the cost of skipping it. An agent that self-corrects in 31 seconds doesn't care that your misconfiguration was an oversight.

This also connects to a bigger shift I keep coming back to in my take on AI's real role in web development: the capability gap between "AI writes code" and "AI operates autonomously in production-adjacent systems" is closing faster than most teams' security practices are.

The Real Question For Your Stack

JadePuffer isn't remarkable because of what it did. Every step it took has existed in attacker playbooks for years. It's remarkable because of what it didn't need: a skilled human, watching, making judgment calls, at every step.

If your security model still assumes the person on the other end gets tired, makes typos, or gives up after a failed login — that assumption is already out of date.

Pro Tip

Running an AI-powered SaaS and not sure what's actually exposed on your infrastructure? I run infra and security audits for founders scaling AI features — the kind of review most teams only think to do after an incident, not before. Worth doing before, not after.