JadePuffer: First Fully Autonomous AI Ransomware

At 19:34:36 UTC, a login attempt failed. Nothing unusual there, broken credentials are the most common error in offensive security. What happened in the next 42 seconds is what made cloud security firm Sysdig sit up: no human read the error, no human typed a fix, and no human confirmed the retry. An autonomous agent diagnosed the failure, rewrote its own payload, and logged in successfully, all on its own. That sequence is the centerpiece of what Sysdig is calling JADEPUFFER, the first ransomware campaign it has documented that ran from initial exploitation through database encryption and extortion without a human operator directing any step.

Key Takeaways

• Sysdig documented JADEPUFFER, a ransomware campaign it says was carried out end to end by an autonomous LLM agent it calls an "agentic threat actor," with no human issuing commands between initial access and the extortion note.
• The agent broke in through CVE-2025-3248, a missing authentication flaw in Langflow's /api/v1/validate/code endpoint that let unauthenticated attackers run arbitrary Python, a bug CISA has since added to its Known Exploited Vulnerabilities catalog.
• Sysdig's logs show the agent diagnosing a broken backdoor login, deleting it, regenerating a working password hash, and confirming success in 31 seconds without human intervention.
• The agent encrypted 1,342 Nacos configuration records using MySQL's AES_ENCRYPT() function and printed the one time encryption key to a terminal session that was never saved, meaning the data is likely unrecoverable even if the ransom is paid.
• Sysdig warns that "the skill floor for running ransomware has dropped to whatever it costs to run an agent," and expects more agentic ransomware campaigns as the underlying tooling matures.

What Made JADEPUFFER Different From Ordinary Ransomware?

Every prior ransomware operation, however automated its encryption stage, still had a human deciding what to exploit, what to steal, and when to pull the trigger on extortion. Sysdig's researchers found none of that in the logs they pulled from a compromised production server. Instead they found what they call an "agentic threat actor," a term meant to describe an attacker whose capability comes from an LLM agent rather than a hand written toolkit.

The clearest evidence wasn't the intrusion itself but the code the intrusion left behind. Sysdig described the payloads as "self narrating," full of natural language reasoning and target prioritization comments that a human operator trying to stay quiet on a compromised box would rarely bother writing, but that LLM generated code produces reflexively as it talks itself through a task. That habit of narrating its own reasoning in code comments is, ironically, what let defenders identify the attack as machine driven in the first place.

How Did the Attacker Get In?

The agent's foothold came from CVE-2025-3248, a critical flaw in Langflow, an open source tool for building AI workflows. The bug sits in the /api/v1/validate/code endpoint, which was designed to check user submitted Python for errors but instead ran that code with Python's exec() before verifying who sent it. Any unauthenticated request could execute arbitrary commands on the host. Langflow's maintainers patched the flaw in version 1.3.0, and the GitHub security advisory confirms the endpoint now requires a valid token.

CVE-2025-3248 wasn't new when JADEPUFFER used it. CISA added the flaw to its Known Exploited Vulnerabilities catalog after separate campaigns deployed the Flodric botnet through the same unpatched endpoint. That JADEPUFFER's operator reused a vulnerability already circulating among conventional botnet crews is itself notable: the agent didn't need novel tradecraft, just an unpatched instance and the ability to chain known techniques faster than a defender could react.

What Did the Agent Do Once It Had a Foothold?

From that first shell, the agent worked through a recognizable intrusion playbook, just without anyone steering it. It dumped Langflow's own PostgreSQL database, pulled host information, searched the filesystem for environment variables and credential files, and enumerated a MinIO object store that was still running on its default credentials.

It then pivoted away from the Langflow box entirely, authenticating to a separate production MySQL server running Alibaba Nacos, a configuration and service discovery tool, using root credentials whose origin Sysdig's investigators could not trace back to the initial compromise. For persistence, it installed a crontab beacon that phoned home to command and control infrastructure every 30 minutes, forged a Nacos JSON Web Token, and inserted a backdoor admin account into the Nacos console.

Inside the 31 Second Self Repair

That backdoor account is where the timeline gets interesting. Sysdig's telemetry captured the sequence almost to the second:

• 19:34:24 UTC, the agent inserts a backdoor account named xadmin with a bcrypt password hash, executed through a subprocess.run() call.
• 19:34:36 UTC, a login attempt with those credentials fails.
• 19:34:48 UTC, instead of moving on, the agent tests default credentials, then independently generates a fresh password hash.
• 19:35:07 UTC, it deploys a corrective payload that deletes the broken account and reinserts it with a properly generated hash, this time importing the bcrypt library directly rather than shelling out to it.
• 19:35:18 UTC, the corrected login succeeds.

The root cause, Sysdig determined, was a subprocess call whose PATH didn't include the bcrypt utility, silently producing an empty password hash. Diagnosing that kind of environment quirk, writing a multi step delete and rebuild fix, and validating the result normally takes a human analyst minutes, not seconds.

How Did the Ransomware Itself Work?

With admin access to Nacos secured, the agent encrypted 1,342 service configuration items using MySQL's built in AES_ENCRYPT() function, then deleted the original config_info and history tables to remove any recovery path. In their place it created a table named README_RANSOM containing a ransom demand, a Bitcoin payment address, and a Proton Mail contact for negotiation, a structure lifted straight from a decade of human run extortion notes, just executed by SQL instead of a text file dropped on a desktop.

There's a catch the note didn't mention. The encryption key was a base64 string generated on the fly and printed to the terminal exactly once; it was never written to disk or transmitted anywhere Sysdig could find. The note also claimed AES-256 encryption, but MySQL's AES_ENCRYPT() defaults to AES-128 in ECB mode unless explicitly reconfigured, which the agent never did. Between the unsaved key and the wrong cipher claim, paying the ransom would likely buy victims nothing, the data isn't being held for ransom so much as destroyed with extra steps.

What Does This Mean for Defenders?

For security teams, the operational takeaway isn't the encryption, MySQL based data destruction isn't new. It's the collapse in what an attack requires. As Sysdig put it: "The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero." LLMjacking, a term Sysdig itself coined, describes attackers running LLM inference on someone else's stolen cloud credentials, meaning the compute behind an operation like JADEPUFFER may not even show up on the attacker's own bill.

That changes what detection needs to look for. Indicators built around known malware families or human operator patterns won't catch an agent that writes fresh code for every target and narrates its own reasoning in the comments. Sub minute retry loops on failed authentication, unusual subprocess calls generating credentials on the fly, and self documenting shell scripts are all more useful signals now than static file hashes. Locking down internet facing AI tooling like Langflow, auditing default credentials on services like MinIO, and treating config management platforms like Nacos as high value targets in their own right are no longer optional hardening steps, they're the front line against an attacker that never sleeps and never gets bored halfway through an intrusion.

What Comes After JADEPUFFER?

Sysdig was careful not to call this a one off. Its researchers expect the volume and sophistication of agentic ransomware campaigns to increase "as agentic tooling matures," and there's little reason to doubt them. It fits a trajectory the same team has been tracking: Sysdig's earlier finding of the first in the wild LLM agent intrusion via a Marimo CVE, and Sophos's discovery of a live AI malware lab hunting EDR bypasses, both pointed straight at this outcome.

The bottleneck on ransomware has never really been encryption code, that's been commoditized for years. It's been the human labor of reconnaissance, credential validation, and troubleshooting broken exploits at 2 a.m. JADEPUFFER shows that labor can now be delegated to a model that debugs itself in under a minute and never asks for a cut of the ransom. The next version of this attack won't need a novel CVE or a clever new encryption trick. It'll just need a slightly better agent, and those are shipping every few months.