AI Agent JadePuffer Executes First Fully Autonomous Ransomware Attack

Security researchers at Sysdig have documented the first fully autonomous ransomware campaign, dubbed JadePuffer. The attack leveraged an unauthenticated vulnerability in the open‑source Langflow framework (CVE‑2025‑3248) to gain code execution on an internet‑exposed instance. Once inside, a large‑language‑model agent performed real‑time reconnaissance, harvested API keys, cloud credentials, cryptocurrency wallets and database passwords, and dumped Langflow’s Postgres database.

The AI then pivoted to a MySQL server running Alibaba’s Nacos configuration service, exploiting a known auth‑bypass (CVE‑2021‑29441) and a default JWT signing key to obtain root access. It used the LLM to generate and execute commands for lateral movement, encrypting 1,342 Nacos configuration items and leaving a Bitcoin‑address ransom note. The ransomware deleted the encrypted data without keeping backups, making recovery impossible even for the attackers.

The operation demonstrates a shift from human‑directed ransomware‑as‑a‑service to “agentic” AI‑driven attacks that can adapt, correct errors, and operate at machine speed. Traditional signature‑based defenses struggle to detect such polymorphic, reasoning‑based command generation. Experts recommend patching Langflow, restricting unauthenticated code execution, rotating credentials, disabling default configurations, and applying strict network segmentation and monitoring.