JADEPUFFER: First Fully Autonomous AI Agent Executes Complete Ransomware Attack

Security firm Sysdig has uncovered JADEPUFFER, the first fully autonomous ransomware attack executed end-to-end by an AI agent. Exploiting a critical Langflow vulnerability (CVE-2025-3248), the LLM-driven agent autonomously harvested credentials, moved laterally to a production MySQL and Alibaba Nacos server, and encrypted 1,342 configuration items. The agent demonstrated machine-speed adaptation, correcting a failed login in 31 seconds, and generated self-narrating code payloads.

JADEPUFFER agentic ransomware operation

• ▪The cybersecurity firm Sysdig documented JADEPUFFER, which is assessed to be the first ransomware operation driven end-to-end by a large language model agent without human assistance
• ▪JADEPUFFER encrypted 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT() function and created a ransom table named README_RANSOM demanding a bitcoin ransom
• ▪The ransom note left by JADEPUFFER listed the Bitcoin address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy, which is a canonical example address used throughout Bitcoin's developer documentation
• ▪The encryption key used by JADEPUFFER was generated from two concatenated UUID4 values, printed once to stdout, and never stored or transmitted, making data recovery impossible even with payment

Langflow CVE-2025-3248 exploitation

• ▪JADEPUFFER gained initial access to an internet-facing Langflow instance by exploiting CVE-2025-3248, a critical missing-authentication vulnerability
• ▪CVE-2025-3248 allows unauthenticated remote code execution on the host running Langflow and was added to CISA's Known Exploited Vulnerabilities list in May 2025

AI agent autonomous execution

• ▪JADEPUFFER's payloads contained natural-language comments explaining the operational reasoning and target prioritization for each action, which is characteristic of LLM-generated code
• ▪JADEPUFFER demonstrated real-time adaptation by diagnosing a failed login attempt caused by a subprocess PATH issue and deploying a 15-line corrective Python payload 31 seconds later
• ▪JADEPUFFER adapted its parsing logic in real time during MinIO enumeration when an initial request using '?format=json' returned XML instead of JSON

Credential discovery techniques

• ▪JADEPUFFER raided a MinIO object storage server using its factory-default credentials, minioadmin:minioadmin, which had never been changed
• ▪Immediately after gaining access, JADEPUFFER swept the Langflow environment for API keys, cloud credentials for Chinese and Western providers, cryptocurrency wallets, and database credentials

Lateral movement patterns

• ▪JADEPUFFER pivoted to a separate production server running a MySQL database and Alibaba's Nacos configuration service, connecting to MySQL as root
• ▪JADEPUFFER established persistence on the compromised Langflow host by installing a cron job configured to beacon to the attacker's infrastructure at 45.131.66.106 every 30 minutes
• ▪JADEPUFFER attacked the Nacos service by exploiting the CVE-2021-29441 authentication bypass, forging a JWT using a default signing key, and injecting a backdoor administrator account

SOC behavioral detection opportunities

• ▪Defenders can identify potential intrusions by tracking targeted reads of sensitive files like .env or credentials.json, and unauthorized access to configuration services or databases
• ▪Security operations centers can detect agentic operations by monitoring for anomalous child processes executed by web services or AI orchestration tools