JadePuffer: Researchers Document First Ransomware Attack Run Entirely by an AI Agent
Security researchers at cloud security firm Sysdig have identified what they believe is the first documented ransomware operation carried out entirely by an autonomous artificial intelligence agent. The operation, dubbed JadePuffer, used a large language model (LLM) agent to perform every stage of the intrusion — reconnaissance, credential theft, lateral movement, persistence, privilege escalation, and finally data encryption — without direct human operation, as BleepingComputer reported.
According to Sysdig, the agent gained initial access by exploiting CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow, an open-source framework for building LLM applications that was patched in April 2025 and later flagged by CISA as actively exploited. Once inside, the agent dumped the host’s PostgreSQL database, hunted for credentials and sensitive files, enumerated a MinIO object store, and installed a cron job that beaconed to attacker infrastructure every 30 minutes. It then pivoted to a production MySQL server running Alibaba Nacos, where it exploited a known authentication bypass (CVE-2021-29441) and ultimately encrypted 1,342 service configuration items before deleting the originals and leaving an extortion table with a Bitcoin address and Proton Mail contact.
What convinced researchers that an AI was in control was the operation’s adaptive behavior: failed steps were retried with refined parameters rather than simple repetition — in one case moving from a failed login to a working fix in 31 seconds — and the generated code contained detailed natural-language comments describing the attacker’s operational reasoning. The operation also showed telltale AI sloppiness: the ransom note claimed AES-256 encryption when weaker AES-128-ECB was likely used, the encryption key was never stored or transmitted to the attacker, and the Bitcoin address in the ransom note was a well-known example address apparently reproduced from training data.
Sysdig concluded that the case signals the arrival of “agentic threat actors,” dramatically lowering the skill required to conduct damaging intrusions — while noting that LLM-generated payloads also create new detection opportunities for defenders.