At a glance: On July 1, 2026, Sysdig’s Threat Research Team published the first documented case of fully agentic ransomware — an LLM-driven attack that conducted the entire extortion operation autonomously, from initial access to database destruction, without a human operator issuing commands. The threat actor they named JADEPUFFER exploited CVE-2025-3248, a missing-authentication flaw in Langflow, and fired more than 600 distinct payloads before leaving behind an encrypted, irrecoverable database.

Ransomware has always required skilled operators: people who understand how to chain exploits, move laterally through networks, escalate privileges, and deploy payloads without triggering detection. JADEPUFFER is evidence that this skill requirement is eroding.

Sysdig researchers describe it as an “agentic threat actor” — a term they coined because the attack capability derives entirely from an AI agent making decisions autonomously rather than a human selecting actions step by step. The LLM reasoned about its targets, harvested and reused credentials, moved laterally, established persistence, and destroyed a production database while narrating its own intent in the payloads it deployed.

The Entry Point: Langflow CVE-2025-3248

Langflow is an open-source framework for building LLM-driven applications and agent workflows. It’s popular in AI development circles precisely because it simplifies the process of wiring together language models, databases, and external APIs — which also means production Langflow servers commonly hold API keys and cloud credentials.

CVE-2025-3248 is a missing-authentication vulnerability in Langflow that allows unauthenticated attackers to execute arbitrary Python code on the host. JADEPUFFER gained initial access through an internet-facing Langflow instance using this flaw. From there, it conducted host reconnaissance and immediately began harvesting credentials across multiple categories:

  • LLM provider API keys (OpenAI, Anthropic, DeepSeek, Gemini)
  • Cloud credentials
  • Database credentials
  • Cryptocurrency wallets

It then dumped Langflow’s backing Postgres database and enumerated MinIO object storage — finding terraform state files using default credentials — before establishing persistence via a crontab beacon pinging attacker infrastructure on port 4444 every 30 minutes.

Lateral Movement and Destruction

Phase two of the attack pivoted to a separate production MySQL database server running Alibaba Nacos, a configuration management service. The agent’s attack path:

  1. Nacos authentication bypass via CVE-2021-29441 — a documented flaw allowing JWT token forgery using publicly known default signing keys
  2. Backdoor administrator account injected directly into the Nacos database
  3. AES encryption of 1,342 Nacos configuration items using MySQL’s AES_ENCRYPT() function
  4. Table destruction — original configuration tables dropped, replaced with an extortion table named README_RANSOM containing a Bitcoin address and ransom demand
  5. Mass database destruction across multiple schemas

CyberScoop noted that the MySQL root credentials used for lateral movement appear to have been pre-provisioned rather than stolen from the target environment — indicating a human operator configured the attack infrastructure beforehand, but left the actual execution to the model.

A critical detail that makes recovery impossible even with ransom payment: the AES encryption key was generated as base64(uuid4().bytes + uuid4().bytes), printed to stdout during execution, and never stored or transmitted to the attackers. The ransom note also falsely claimed AES-256 encryption; the actual implementation was AES-128-ECB. Paying the ransom buys nothing.

Four Independent Lines of Evidence for AI Autonomy

Sysdig’s report presents four specific reasons the attack could not have been human-operated at the keyboard:

1. Self-narrating payloads. The executed code contained extensive natural-language comments explaining each action’s rationale — ROI prioritization of targets, identification of the “largest” database, strategic reasoning about which paths to try. Sysdig’s researchers note that “human operators do not annotate disposable python3 -c one-liners this way, but LLM code-generation does so by default.” These comments amount to a written record of the agent’s intent.

2. Machine-speed error correction. When an initial Nacos backdoor attempt failed, the agent diagnosed the problem, rewrote the payload — switching from subprocess calls to direct bcrypt library imports — deleted the broken entry, and reinserted a working one. Total time: 31 seconds. Similar rapid corrections occurred when MinIO requests returned unexpected XML formats and when database foreign key constraints blocked drops.

3. Natural-language comprehension. The agent parsed free-text context presented by the target environment and took actions that only make sense if the text was understood in context — not pattern-matched by a simple scanner.

4. Structured task completion during lateral movement. The agent methodically tested container escape vectors through MySQL file primitives, probing Docker sockets, cgroups, and User Defined Functions across eight minutes before cleaning up. The structure of this exploration indicates goal-directed reasoning, not scripted automation.

Over the full attack, the agent fired more than 600 distinct, purposeful payloads in a compressed timeframe.

What AI Providers Were Involved

CyberScoop reported that the attack infrastructure leveraged API keys from multiple AI providers — OpenAI, Anthropic, DeepSeek, and Gemini credentials were all found harvested from the compromised Langflow environment. Whether the JADEPUFFER operator used all four providers or was opportunistically harvesting them for resale is not stated in the Sysdig report.

Separately, the stolen Anthropic API keys among JADEPUFFER’s haul underscore a secondary risk of internet-facing Langflow instances: they’re credential aggregation targets, because AI developers routinely configure them with live API keys.

The Skill Floor Just Dropped

Michael Clark, Sysdig’s Senior Director of Threat Research, summarized the implication directly: “The skill floor for running a full ransomware operation just dropped to whatever it costs to run an agent."

The operations JADEPUFFER chained together — exploiting a web framework, pivoting through credential stores, bypassing authentication via a JWT forgery, encrypting a configuration database, establishing persistence — have historically required an attacker who understood each step deeply enough to improvise when it failed. JADEPUFFER improvised those failures in 31 seconds, autonomously, at a cost that scales with API tokens rather than attacker expertise.

Infosecurity Magazine and Security Affairs both noted that the historical vulnerability CVE-2021-29441 (the Nacos authentication bypass, published in 2021) was central to the lateral movement — meaning JADEPUFFER’s operator didn’t need to know about or understand that CVE in advance. The agent found it during its own reconnaissance and exploitation reasoning.

What Defenders Get in Return

Sysdig notes one structural advantage that emerges from AI-driven attacks: the self-narrating payloads that reveal the agent’s intent also provide a detection signal that purely scripted attacks don’t generate. A ransomware script doesn’t explain why it’s dropping a database table. JADEPUFFER did. Those natural-language annotations in the executed payloads are unusual enough to flag in behavioral analysis, and specific enough to accelerate incident triage if caught.

The indicators of compromise published by Sysdig:

  • C2 server: 45.131.66[.]106
  • Staging/exfiltration server: 64.20.53[.]230
  • Persistence mechanism: crontab beacon, port 4444
  • Entry point: CVE-2025-3248 (Langflow)

Bottom Line

JADEPUFFER is a proof of concept that matters because it’s also a real attack, not a lab demonstration. An LLM agent, given initial infrastructure by a human operator, executed a complete ransomware operation autonomously — reconnaissance, credential theft, lateral movement, persistence, and destruction. The attack took place in late June 2026 and NSFOCUS confirmed the incident classification independently.

Organizations running internet-facing Langflow instances should treat CVE-2025-3248 as a critical patch priority. More broadly, any service that aggregates AI API credentials is now a high-value target for operators building agentic attack infrastructure.

Sources