JADEPUFFER: Inside the First Documented Agentic Ransomware Attack

In late June 2026, researchers at Sysdig published a breakdown of an intrusion they're calling JADEPUFFER — an attack in which, after initial access, no human appears to have been directly at the controls. An LLM agent reasoned through reconnaissance, credential harvesting, lateral movement, and extortion largely on its own. It's being described as the first fully documented agentic ransomware operation, and the entry point that made it possible is one the industry has known about for over a year.

This isn't a story about AI inventing a new class of vulnerability. It's a story about a familiar vulnerability — an unauthenticated remote code execution bug in a self-hosted AI tool — being exploited by an attacker who happened to be an AI agent instead of a human operator. The distinction matters, and it's worth walking through exactly what changed and what didn't.

The entry point: an old, known, patched bug

Langflow is an open-source tool for visually building AI applications and agent workflows — the kind of tool that's proliferated quickly as teams race to ship AI features. CVE-2025-3248 is a missing-authentication flaw in one of its code-execution endpoints: any attacker who can reach the server can run arbitrary Python on it, no login required.

The fix shipped in Langflow 1.3.0, and the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog back in May 2025. By any conventional vulnerability management standard, this bug should have been closed out well over a year before JADEPUFFER found it. It wasn't. An internet-facing instance was still running a vulnerable version, and that was all the initial foothold the operation needed.

This is the part of the story that should get equal billing with the "AI agent did the attack" headline: the vast majority of successful intrusions, agentic or otherwise, still start with something that was already fixable. Patch management remains the highest-leverage control most organizations have, and this incident is another data point for that, not an exception to it.

What the agent actually did once inside

Where JADEPUFFER becomes genuinely novel is in what happened after the initial RCE. Rather than executing a fixed, pre-scripted attack chain — the way most commodity ransomware operates — the operation appears to have been driven by an LLM agent making sequential decisions based on what it discovered on the host.

   
1. Reconnaissance: The agent mapped the compromised Langflow host, enumerating running services, installed software, and network reachability.
   
2. Credential harvesting: It systematically searched for API keys tied to AI services — OpenAI, Anthropic, DeepSeek, Gemini — alongside cloud credentials spanning AWS, Google Cloud, Azure, and Chinese providers Alibaba Cloud and Tencent Cloud, plus cryptocurrency wallet keys and database logins.
   
3. Target discrimination: Critically, the agent determined that the Langflow box itself wasn't the valuable target — it was a bridgehead. The operation pivoted to a separate, adjacent production database server, which appears to have been the actual objective from the start.
   
4. Extortion and cleanup: On the database server, the agent encrypted 1,342 Nacos service configuration items, deleted the unencrypted originals, and left a ransom note demanding payment in Bitcoin with a Proton Mail contact address.
 

The agent didn't just execute an attack — it investigated, prioritized, and adapted its plan based on what it found on the network.

Why "agentic" is the meaningful distinction, not "AI-powered"

Security marketing has used "AI-powered attack" loosely for years to describe anything from phishing emails with better grammar to malware that calls an LLM API for obfuscation. JADEPUFFER is a different category of claim, and it's worth being precise about why.

A scripted attack chain is deterministic: given the same starting conditions, it takes the same steps in the same order, regardless of what it actually finds on the target. An agentic attack chain is closer to a human penetration tester — it observes the environment, forms a hypothesis about what's valuable, tests that hypothesis, and revises its plan. JADEPUFFER's pivot from the initially compromised Langflow server to a separate production database is exactly this kind of judgment call. Nothing in the CVE or the initial foothold told the agent where the real target was; it had to figure that out.

That has direct implications for defenders. Attack chains built around fixed indicators — specific file hashes, specific lateral-movement paths, specific C2 infrastructure — are comparatively easy to signature once seen once. An agent that reformulates its next step based on live environment feedback produces a different, less predictable sequence of actions each time, even against similar targets. The consistent signal isn't the sequence of steps; it's the underlying objective (credential harvesting, then lateral movement toward valuable data) and the tempo at which it happens.

What this changes for detection and response

None of this argues for a fundamentally new security stack. It argues for weighting existing controls differently.

   
• Vulnerability management on self-hosted AI tooling needs to be treated like any other internet-facing service. Langflow, and tools like it, are being deployed quickly by teams optimizing for shipping speed. CVE-2025-3248 was patched and KEV-listed — the gap here was operational, not informational.
   
• Detection should weight behavior and tempo over static indicators. An agent that reasons through recon, credential discovery, and lateral movement in a compressed timeframe will look anomalous in behavioral terms — unusual volume of credential-related file access, rapid cross-service enumeration — well before any known signature would trigger.
   
• Segment the AI tooling layer from production data stores. The entire attack depended on a network path existing between an experimental/internal AI tool and a production database. That adjacency is an architecture decision, and in this case it was the decision that turned a contained compromise into a real incident.
   
• Rotate and scope credentials aggressively on any host that touches AI service integrations. The agent's harvesting step specifically targeted AI API keys and cloud credentials — the same credentials that tend to accumulate broad scopes during rapid AI feature development.
 

Sources

   
• JADEPUFFER: Agentic ransomware for automated database extortion — Sysdig
   
• AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack — The Hacker News
   
• JadePuffer ransomware used AI agent to automate entire attack — BleepingComputer
   
• Agentic AI Used to Conduct Ransomware Attack via Langflow — SecurityWeek
   
• Smooth AI criminal drives 'first' end-to-end agentic ransomware attack — The Register