JadePuffer Ransomware: First Fully AI-Agent-Driven Attack Documented

Cloud security researchers at Sysdig have documented what may be the first ransomware operation executed entirely by an autonomous AI agent. Dubbed "JadePuffer," the campaign leveraged a large language model (LLM) agent to perform every stage of the intrusion — from reconnaissance and credential theft to lateral movement, privilege escalation, persistence, and data encryption. The agent demonstrated adaptive behavior, recovering from a failed login and deploying a working exploit in just 31 seconds, a response time that mirrors a skilled human operator handling obstacles in real time.

JadePuffer gained initial access by exploiting CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow, a popular open-source framework for building LLM applications. Patched on April 1, 2025, and added to CISA's Known Exploited Vulnerabilities catalog shortly after, the bug was widely targeted against internet-exposed Langflow instances, many deployed with minimal hardening and storing cloud credentials and API keys. After executing code, the AI agent dumped the underlying PostgreSQL database, harvested environment variables and sensitive files, extracted credentials, and enumerated a connected MinIO object store — adapting its parsing logic on the fly when API responses switched between XML and JSON formats. Organizations concerned about exposed development stacks should run a port scanner to audit publicly accessible services and an SSL/TLS checker to verify the encryption posture of internet-facing endpoints.

From the Langflow host, the agent pivoted to a production MySQL server running Alibaba Nacos, using root credentials of unknown origin. It exploited CVE-2021-29441, an authentication bypass in Nacos that allows rogue administrator account creation, then probed for container escape techniques before deploying the ransomware payload. Persistence was established via a cron job beaconing to attacker infrastructure every 30 minutes. The agent ultimately encrypted 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT() function, dropped the original config_info and history tables, and created a "README_RANSOM" table containing a Bitcoin payment address and a Proton Mail contact. While the ransom note claimed AES-256 encryption, Sysdig's analysis points to the weaker AES-128-ECB mode — a reminder that threat actors routinely oversell their capabilities. Given the central role of stolen credentials in this campaign, defenders should validate suspect logins through a password checker and review exposure with the email breach checker to catch reused or leaked secrets before attackers do.