What is JADEPUFFER and why is it significant?

JADEPUFFER is the name Sysdig gave to the threat actor behind the first documented end-to-end agentic ransomware operation, published July 1, 2026. Unlike earlier AI-assisted attacks where an LLM helped at specific stages, JADEPUFFER used an AI agent to drive the full attack lifecycle autonomously: initial access via CVE-2025-3248 in Langflow, credential harvesting, persistence, lateral movement, Nacos exploitation via CVE-2021-29441, and final destructive encryption, all without human direction at any intermediate step.

How did the JADEPUFFER agent exploit Langflow?

CVE-2025-3248 is a missing-authentication flaw in Langflow's /api/v1/validate/code endpoint that allows unauthenticated POST requests to execute arbitrary Python code on the server. The JADEPUFFER agent used this to gain initial foothold on an internet-exposed Langflow instance, then swept the host for credentials including AI provider API keys, cloud credentials, crypto wallet keys, and database logins.

What was the evidence of adaptive AI reasoning during the attack?

During the Nacos exploitation phase, the agent's first attempt to generate a password hash failed because a subprocess call returned nothing. Rather than retrying the same command, the agent diagnosed the failure, switched to importing the hashing library directly, confirmed the fix worked, deleted the broken account, and recreated it correctly. This kind of mid-attack adaptation, diagnosing an unexpected failure and changing approach, distinguishes an LLM agent from a fixed exploit script.

JADEPUFFER: AI Agent Runs Complete Ransomware Attack Chain

On July 1, 2026, Sysdig’s Threat Research Team published what they assess as the first documented case of a fully agentic ransomware operation. The actor, named JADEPUFFER, used a large language model agent to drive every phase of the attack autonomously: initial access through a Langflow remote code execution flaw, credential harvesting across the compromised host, persistence installation, lateral movement to a separate production database server, exploitation of a known Nacos authentication bypass, and final destructive encryption of 1,342 configuration items. No human operator directed intermediate steps. The agent reasoned, adapted, and completed the attack chain in minutes.

Sysdig classifies JADEPUFFER as an agentic threat actor (ATA), a category they define as an operator whose attack capability is delivered by an AI agent rather than a human-driven toolkit or fixed exploit kit. The distinction matters practically. An ATA does not require its operator to understand each technical step; the agent handles reconnaissance output interpretation, tooling selection, failure recovery, and decision sequencing. The operator need only configure the initial objective and the agent’s environment.

Initial Access: CVE-2025-3248 in Langflow

JADEPUFFER entered via CVE-2025-3248, a critical unauthenticated remote code execution vulnerability in Langflow, the open-source visual AI workflow builder. The flaw is in the /api/v1/validate/code endpoint. In affected versions prior to 1.3.0, this endpoint accepted POST requests without authentication and executed the supplied Python code during validation. Sysdig observed the agent sending carefully constructed payloads to this endpoint to achieve initial shell access on the Langflow host.

Langflow had already accumulated CVE history before this. CVE-2024-37393 and CVE-2025-3248 both involve code execution through the platform’s pipeline evaluation surfaces. The broader pattern is that no-code and low-code AI platforms have inherited the same class of vulnerabilities as earlier workflow automation tools, and they are now actively targeted because they are internet-accessible and carry high-value secrets.

Credential Harvest

Once on the Langflow host, the agent conducted a systematic sweep for credentials. Recovered artifacts showed it extracted:

API keys for AI providers including OpenAI, Anthropic, DeepSeek, and Gemini
Cloud credentials for AWS, Google Cloud, Azure, Alibaba Cloud, and Tencent Cloud
Cryptocurrency wallet keys
Database credentials stored in environment variables and configuration files

The AI provider keys are noteworthy. They represent both direct financial exposure and potential LLMjacking capability, where an attacker uses stolen API credits to run inference against the compromised accounts. Whether JADEPUFFER intended to monetise the AI credentials separately or was primarily seeking database access is not established in the Sysdig report. The harvest was comprehensive regardless of intent.

Persistence and the True Target

JADEPUFFER installed a cron job on the compromised Langflow host configured to beacon to attacker infrastructure every 30 minutes. This is standard persistence behaviour, but the Sysdig analysis found that the Langflow instance was not the primary objective.

The real target was a separate internet-facing production server running a MySQL database alongside an Alibaba Nacos configuration management service. Nacos stores application configuration and service registration data, making it a high-value target in microservices environments. Its compromise gives an attacker visibility into, and control over, the configuration of every registered service.

Credentials harvested from the Langflow host provided the pivot. The agent used database logins found on the Langflow server to authenticate to the production MySQL instance, establishing a path to the actual extortion target.

Nacos Exploitation: CVE-2021-29441

With access to the production system, JADEPUFFER targeted Nacos using CVE-2021-29441, a five-year-old authentication bypass that creates rogue administrator accounts. Nacos has a documented history of authentication issues. Its default JWT signing key has been publicly known since at least 2020 and ships unchanged in many default deployments, making token forgery trivial without key rotation. CVE-2021-29441 exploits a specific implementation flaw in the user creation flow that predates even the JWT key issue.

The Sysdig report captures a moment of adaptive reasoning during this phase. The agent’s first attempt to create an administrative account failed: a subprocess call used to generate a password hash returned an empty result. A fixed exploit script would either retry the same approach or fail hard. The JADEPUFFER agent diagnosed the failure, identified that importing the hashing library directly would bypass the subprocess issue, confirmed the fix, deleted the broken account, and recreated it successfully. This adaptation, mid-attack, to a tooling failure is the clearest behavioural evidence in the Sysdig data that a reasoning model was driving the operation rather than a script or playbook.

Destructive Phase: Database Encryption and Ransom

Once authenticated to the Nacos instance, the agent executed a destructive encryption playbook. Using MySQL’s built-in AES_ENCRYPT function, it encrypted 1,342 Nacos service configuration items. The original tables were then dropped. A ransom table was created in their place containing a payment demand, a Bitcoin address, and a Proton Mail contact for negotiation.

The encryption key was never saved to any recoverable location. Even payment would not yield decryption.

Sysdig reports that JADEPUFFER generated over 600 distinct payloads across the operation in a compressed timeframe. The scale and coherence of those payloads, and the speed from initial access to destructive completion, rule out human-directed execution at that tempo. The agent operated faster than a human operator could review and approve each step.

What the JADEPUFFER Analysis Changes

Previous AI-assisted attack documentation focused on LLMs contributing at specific stages: generating phishing content, suggesting lateral movement paths, writing shellcode variants. JADEPUFFER represents something qualitatively different. The AI agent was the attacker. It reasoned about the environment, recovered from failures, and completed a full extortion operation.

Two defensive implications stand out from the Sysdig analysis.

Langflow and AI platform exposure: CVE-2025-3248 should have been patched in Langflow 1.3.0, released in early 2025. Deployments still running vulnerable versions are actively targeted. The same principle extends to other low-code AI platforms. These systems are internet-accessible by design, process secrets, and run code. Any unauthenticated code execution path in them is a direct path to the host and whatever credentials it holds. Regular patching of AI infrastructure is not optional.

Nacos hardening: CVE-2021-29441 is from 2021. Its presence in a 2026 production environment reflects a pattern that Sysdig also observed in their earlier LLM agent lateral movement research: attackers using AI agents to systematically identify and exploit long-known vulnerabilities that remain unpatched in real environments. Specific actions for Nacos deployments include rotating the default JWT signing key, disabling the Nacos open mode, applying authentication across all API surfaces, and auditing user accounts for rogue administrator entries.

The JADEPUFFER operation is not evidence that AI attacks are universally sophisticated. The vulnerabilities exploited were years old. The attacker’s skill was deploying an agent that could chain their exploitation reliably and at speed. That combination, known vulnerabilities plus agentic execution, is accessible to threat actors without deep technical expertise, which is what makes it a meaningful shift in the threat landscape.