JadePuffer AI Agent Executes First Fully Autonomous Ransomware Attack

Cybersecurity researchers at Sysdig have documented what they describe as the first ransomware campaign run end‑to‑end by an autonomous large‑language‑model (LLM) agent, dubbed JadePuffer. The AI exploited the publicly disclosed CVE‑2025‑3248 remote‑code‑execution flaw in the open‑source Langflow framework to gain initial access to an internet‑exposed server. From there it performed reconnaissance, harvested cloud API keys and cryptocurrency wallet data, moved laterally, and compromised an Alibaba Nacos configuration service backed by a MySQL database. The agent encrypted 1,342 Nacos configuration records, deleted the originals and left a Bitcoin‑address ransom note.

The malicious payloads were self‑narrating, containing natural‑language comments that explained each decision. When a login attempt failed, the AI diagnosed the error and rewrote its exploit logic, succeeding within 31 seconds—speed far beyond a human operator. Sysdig notes that a human actor still selected the target, provisioned the command‑and‑control infrastructure, and supplied stolen credentials used for the initial foothold, but the AI carried out the technical execution without further human input. The researchers warn that agentic AI lowers the technical skill floor for ransomware, enabling cheaper, faster campaigns and expanding the attack surface of unpatched, internet‑facing services.

The incident highlights the need for rapid patching of known vulnerabilities, tighter secret management, and new detection methods that can spot AI‑generated attack behavior.