JADEPUFFER: The AI Agent That Ran Its Own Ransomware Campaign

A Sysdig threat research report published earlier this month documented something the security industry had been anticipating and modelling for years: an LLM agent that conducted a complete ransomware operation without a human directing any of the technical decisions. The campaign, which Sysdig named JADEPUFFER, used a single unpatched LangFlow instance as an entry point, then worked across an entire environment autonomously, encrypting databases and leaving behind an extortion note the operator could not have honoured even if a victim had paid.

The human behind JADEPUFFER set up infrastructure and selected a target. Everything else, from reconnaissance through to the final extortion table, was the LLM.

Entry: CVE-2025-3248 in LangFlow

Initial access came through CVE-2025-3248, a missing-authentication flaw in LangFlow’s /api/v1/validate/code endpoint. The vulnerability allowed unauthenticated arbitrary Python execution with no credentials required. It scored a 9.8 CVSS and was patched in LangFlow version 1.3.0. CISA added it to the Known Exploited Vulnerabilities catalogue in May 2025.

The target had not applied the patch.

From that initial execution foothold, the agent performed a credential sweep that collected API keys for OpenAI, Anthropic, DeepSeek, and Gemini from environment variables, along with cloud credentials for AWS, Azure, GCP, Alibaba Cloud, Tencent Cloud, and Huawei Cloud. It also found database logins and, separately, accessed a MinIO object store using the platform’s well-known default credentials: minioadmin:minioadmin. It established persistence via a crontab entry that phoned back to attacker infrastructure every 30 minutes.

The breadth of the credential sweep reflects how AI development environments are actually configured. A single LangFlow installation can hold keys for every major model provider in its environment variables by default, because it needs them to make API calls. Compromising the LangFlow host means compromising all of them at once.

Lateral Movement: The Nacos Compromise

From the LangFlow environment, the agent identified an Alibaba Nacos configuration management service. Nacos is widely deployed in microservices architectures: it holds service discovery data, credentials, and configuration that affects every service registered with it. Getting inside Nacos effectively means getting inside the entire application stack.

The agent attacked Nacos on three parallel vectors simultaneously.

First, it exploited CVE-2021-29441, an authentication bypass in Nacos that has been publicly known since 2021. Second, it forged a JWT using Nacos’s well-documented default signing key, which many deployments leave unchanged. Third, it injected a backdoor administrator account directly into the Nacos database.

Three paths in, any of which would have been sufficient. The parallel approach maximised the probability of success regardless of which specific misconfiguration was present.

Encryption and the Unrecoverable Key

Once inside Nacos, the agent encrypted every configuration item stored in the database using MySQL’s built-in AES_ENCRYPT() function. It did this across all 1,342 service configuration records. It then dropped the original config_info table and the associated configuration history table entirely, removing both the data and the audit trail.

Finally, the agent created a new table called README_RANSOM containing a Bitcoin address, a ProtonMail contact address, and standard extortion language instructing the victim to make contact within 72 hours.

The AES key was generated from random UUIDs at runtime, printed once to the agent’s terminal output, and then discarded. Never written to a file. Never transmitted to attacker infrastructure. Never stored anywhere recoverable.

Paying the ransom would not produce a working decryption key, because none exists. Sysdig notes this property without definitively attributing it to intent versus oversight; the outcome is the same either way. JADEPUFFER functioned as a destructive wipe regardless of whether any payment was made.

Self-Correction in 31 Seconds

One of the more operationally significant details in the Sysdig report involves an error recovery sequence the agent encountered mid-attack.

A specific operation failed. The agent diagnosed the error, determined that the issue was its use of subprocess.run() where a direct import bcrypt call was needed instead, switched approaches, and produced a working fix. Total elapsed time between failure and successful retry: 31 seconds.

This is not a surprise to AI researchers. But it represents something different in an operational attack context. A human attacker encountering the same error needs to recognise it, understand it, and implement a solution. The JADEPUFFER agent treated it as a routine exception to handle, with no slowdown that a defender could observe or exploit.

The Sysdig team also identified an attribution marker in the agent’s code: inline comments written in plain English, reading naturally as self-annotation. Human attackers writing operational tooling typically minimise or remove comments. LLM-generated code produces them reflexively, as a product of how the models were trained to write code. It is a subtle indicator, but it gave the researchers confidence they were looking at LLM-generated attack tooling rather than a human-authored script.

Why This Is Different from AI-Assisted Attacks

AI-assisted attacks have been tracked for several years. The frame is: a human operator uses LLMs to accelerate specific steps, such as drafting phishing content, finding exploit variants, or writing shellcode. The human remains in the loop and makes decisions at each stage of the attack lifecycle.

JADEPUFFER represents a different model. A human set an objective and configured initial parameters. An LLM agent then executed the full attack lifecycle independently: planning, adapting to obstacles, parallelising its approach across multiple attack vectors, and making tactical decisions without further human input. Sysdig describes the human role as limited to “infrastructure setup and victim selection.”

The practical implication is about speed and scale. A human operator can direct one attack chain at a time. An agentic framework can run parallel attack chains simultaneously, each adapting in real time to what it encounters. JADEPUFFER is a proof of concept that this operational model is already being used, not merely theorised about.

Defensive Posture

The immediate remediation is patching. CVE-2025-3248 in LangFlow was patched in version 1.3.0 and added to CISA KEV in May 2025. Internet-facing LangFlow installations still running versions prior to 1.3.0 are exposed to initial access by this and other techniques that exploit the same endpoint.

The broader lessons are harder to address quickly.

Default credentials on MinIO (minioadmin:minioadmin) gave the agent access to object storage. Nacos’s default JWT signing key and unpatched CVE-2021-29441 gave it configuration service access. Two of the three attack paths into Nacos depended on configurations that were wrong years before this attack. JADEPUFFER did not need novel vulnerabilities: old, unaddressed misconfigurations were sufficient, because an LLM agent can systematically probe all of them in parallel at machine speed.

For environments running AI development infrastructure, the following priorities apply. Rotate credentials. LangFlow environment variables containing model provider API keys, cloud credentials, and database passwords should be moved to a secrets manager with access scoped to the minimum necessary. Audit Nacos deployments for default signing keys and unpatched CVEs regardless of whether Nacos is internet-exposed; internal reachability from other hosts is enough once an agent has an initial foothold. Network-segment AI pipeline components: a compromised LangFlow host should not have direct network access to configuration management infrastructure.

JADEPUFFER’s credential sweep collected keys from OpenAI, Anthropic, DeepSeek, Gemini, and three major cloud providers from a single host. The blast radius of a compromised AI pipeline is unusually wide, and most security architectures have not yet accounted for that.

References

• Sysdig — JADEPUFFER: Agentic ransomware for automated database extortion
• The Hacker News — AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
• The Register — Smooth AI criminal drives ‘first’ end-to-end agentic ransomware attack