Cybersecurity researchers have documented what they describe as the first known ransomware operation orchestrated entirely by an autonomous AI agent, marking a significant escalation in the automation of cyberattacks. The operation, tracked as JadePuffer, used a large language model (LLM) agent to execute every phase of the intrusion—from initial reconnaissance and credential theft to lateral movement, privilege escalation, and data encryption—without direct human intervention.
How the JadePuffer AI Agent Operated
According to analysis from cloud security firm Sysdig, the JadePuffer agent demonstrated adaptive behavior throughout the attack chain. When a step failed, it dynamically adjusted its approach, mirroring how a human operator would troubleshoot obstacles. In one sequence observed by researchers, the agent transitioned from a failed login attempt to a working fix in just 31 seconds, refining its parameters in real time.
Sysdig states that the agent’s payloads contained detailed natural-language comments explaining operational reasoning, and the iteration logic responded to specific error messages rather than performing simple retries. These characteristics strongly suggest that the attack was driven by an LLM rather than a conventional automated script.
Initial Access Through a Langflow Vulnerability
JadePuffer gained initial access by exploiting CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, an open-source framework used for building LLM applications. The flaw was patched on April 1, 2025, and by early May, CISA had confirmed active exploitation against internet-exposed Langflow endpoints. These deployments often run with minimal hardening yet contain cloud credentials and API keys, making them attractive targets.
Once code execution was achieved, the AI agent dumped the Langflow instance’s PostgreSQL database, collected host information, scanned for environment variables and sensitive files, retrieved credentials, and enumerated a MinIO object store. Sysdig highlights the agent’s adaptive approach to MinIO enumeration: when an API request returned XML instead of JSON, the next payload adjusted its parsing logic accordingly.
Persistence was established by installing a cron job on the compromised Langflow server that beaconed to the attacker’s infrastructure every 30 minutes.
Pivoting to Production Systems and Encrypting Configuration Data
From the Langflow host, the agent pivoted to a production MySQL server running Alibaba Nacos (Naming and Configuration Service), using root credentials whose origin Sysdig could not determine. The agent then targeted Nacos with multiple payloads, including one exploiting CVE-2021-29441, an authentication bypass vulnerability that allows the creation of rogue administrator accounts.
The agent probed for container escape methods before deploying the ransomware payload. Sysdig reports that JadePuffer encrypted 1,342 Nacos service configuration items using MySQL’s AES_ENCRYPT() function, then dropped the original config_info and history tables. A ransom table named README_RANSOM was created containing the ransom demand, a Bitcoin payment address, and a Proton Mail contact.
The ransom note claims the data was encrypted with AES-256, but researchers believe AES-128-ECB was more likely used. Sysdig notes that although the encryption key was randomly generated, it was not stored or transmitted to the attacker, meaning decryption would be impossible even if a ransom were paid. The Bitcoin address listed in the note was an example address commonly found in public documentation, possibly reproduced from the LLM’s training data.
What This Means for Security Teams
Sysdig concludes that JadePuffer demonstrates the arrival of what it terms “agentic threat actors” (ATAs)—AI-driven adversaries that lower the skill barrier for conducting damaging cyberattacks. Because LLM-generated payloads operate with distinct patterns, however, they also create new detection opportunities for security solutions. Organizations should review exposure of internet-facing AI application frameworks like Langflow, ensure Nacos instances are patched against CVE-2021-29441, and monitor for rapid, adaptive authentication attempts or configuration changes that deviate from scripted behavior.
What Organizations Should Do Now
Any organization running Langflow or Nacos should immediately verify that instances are not exposed to the internet without strict access controls. Apply patches for CVE-2025-3248 and CVE-2021-29441 if not already deployed. Review cloud credential storage practices—credentials embedded in environment variables or configuration files on internet-accessible hosts present a direct risk. Security teams should also evaluate their detection pipelines for signs of adaptive, context-aware payloads that adjust based on error responses, as this behavior may indicate AI-driven intrusion activity. Deploying a multi-layer endpoint protection solution with behavioral analysis and real-time threat detection can help identify anomalous process execution and lateral movement associated with agentic attacks.
