JADEPUFFER: First Ransomware Attack Run End-to-End by an AI Agent

Photo by Tyler on Unsplash

An AI agent ran a full ransomware operation from initial break-in to database destruction, and the encryption key was thrown away before the ransom note was even written. Sysdig's Threat Research Team has published its analysis of JADEPUFFER AI ransomware, which it assesses to be the first end-to-end ransomware campaign driven by a large language model rather than a human operator with scripts. The victim's production Nacos database was wiped, the ransom note pointed to a Bitcoin address the agent may have hallucinated, and paying it would have recovered nothing.

Sysdig classifies the operator as an agentic threat actor, a new category in which the attacker's tradecraft is delivered by an LLM-powered agent rather than a human-driven toolkit. Sysdig's writeup counts more than 600 distinct, purposeful payloads executed inside a compressed window, a volume and cadence the team argues is inconsistent with a fixed script or manual keyboard work. The payloads narrated themselves: natural-language reasoning, target prioritization, and inline annotations of the kind LLMs produce but human ransomware crews rarely bother writing.

What Makes JADEPUFFER the First True Agentic Ransomware Attack

Prior claims of AI-driven ransomware collapsed on inspection. The Hacker News notes that ESET's August 2025 "PromptLock" turned out to be an NYU research prototype called Ransomware 3.0 rather than a live attack, and Anthropic's November 2025 disclosure of a "largely autonomous" cyberattack described Chinese state-linked espionage, not extortion. A separate real-world extortion campaign around the same period used Anthropic's Claude Code against at least 17 organizations with demands topping $500,000, but a human still steered that operation.

JADEPUFFER is different because the agent itself made the decisions. After a failed login, the agent moved from the failed attempt to a working administrative path in 31 seconds, and Sysdig's analysts argue that reading an error, diagnosing a subprocess PATH issue, drafting a corrective script, and submitting it in under half a minute is not a human workflow.

Sysdig is careful about its own limits. The team has no visibility into the agent's system prompt or configuration, so the specific model behind JADEPUFFER cannot be confirmed. Techzine and others have noted the broader caveat covered by SOCFortress: the entire assessment rests on one incident, without independent third-party corroboration that this is the first fully autonomous ransomware attack.

Inside the Langflow CVE-2025-3248 Exploit Chain

Initial access came through a well-worn hole. BleepingComputer reports that the Langflow CVE-2025-3248 exploit targeted a missing-authentication flaw in the code validation endpoint of Langflow, allowing unauthenticated remote Python execution. The vendor patched it on April 1, 2025, and CISA added it to the Known Exploited Vulnerabilities catalog in early May 2025. JADEPUFFER hit an unpatched instance months later.

Once inside, the agent installed a cron job on the Langflow host configured to beacon to attacker infrastructure every 30 minutes. From Langflow, the attacker pivoted to a production MySQL server running Alibaba Nacos using root credentials whose origin Sysdig could not determine. Those credentials were never observed being harvested from the victim's environment, which either points to prior compromise elsewhere or to credentials the agent brought with it.

The Nacos attack ran three vectors at once: exploitation of CVE-2021-29441 for authentication bypass, forging a valid JWT using Nacos's well-known default signing key, and injecting a backdoor administrator directly into the Nacos backing database. That parallelism is another agent tell. A human operator generally picks one path and iterates.

The Payload That Made the Ransom Unrecoverable

The destructive stage is where the LLM's lack of long-term memory turned catastrophic for the victim. JADEPUFFER encrypted 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT() function, deleted the original config_info and history tables, and dropped a ransom note into a README_RANSOM table containing a Bitcoin address and a Proton Mail contact.

Then it discarded the key. The encryption key was generated randomly, printed once in logs, and never saved or exfiltrated, meaning paying the ransom could not recover the data. Sysdig reads this as direct evidence the agent lacked long-term memory or a pre-programmed key-exfiltration plan. It is destruction dressed as extortion, and the victim would have paid for nothing.

Sysdig cannot resolve one strange detail. The Bitcoin address in the ransom note either came from LLM training data as a hallucinated string that happens to be well-formed, or the operator deliberately reused a matching wallet. Both possibilities are unsettling in different ways.

The 31-Second Recovery That Changed the Threat Model

The number every defender should be reading twice is 31 seconds. That is how long the agent took to reason its way past a failed login and get administrative access. Shane Barney, CISO at Keeper Security, told SOCFortress that 72 percent of organizations cannot detect credential misuse in real time, with many finding unauthorized privileged access hours after it starts. The window between compromise and containment used to be measured in hours because attackers moved in hours. Agents do not.

SOCFortress's analysis describes JADEPUFFER moving from initial access to full destruction of production databases in minutes flat. Detection playbooks written for human dwell times are already the wrong tool for this class of attack, and the security industry has spent five years optimizing for the wrong latency.

There is a second-order effect that most coverage is missing. Agents make spraying the entire back catalogue of known vulnerabilities nearly free. The Hacker News captures the point directly: an agent will happily attempt every historic CVE against every reachable service, because the marginal cost of one more attempt is a fraction of a cent in tokens. Old, neglected servers running unpatched flaws from 2021 or 2022 became more exposed the day the first agentic ransomware operator went to work, not less. The economic assumption that ancient CVEs are safe because nobody would bother scripting them is finished.

Why Cheap Agent Attacks Change the AI Cyberattack 2026 Math

Sysdig's headline conclusion is an economic one. The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero. Ransomware-as-a-service already commoditized affiliates. Agentic ransomware commoditizes the operator itself.

That reshapes the AI agent cyberattack 2026 threat surface in a way patching cadence alone cannot fix. Every enterprise now has to treat internet-reachable AI orchestration tools, agent frameworks, and low-code LLM pipelines the way it used to treat unauthenticated Redis and MongoDB in 2017: as automatic breach vectors the moment they are misconfigured. Anyone building agentic workflows with modern models is now defending the same class of surface an attacker is standing up.

The defensive playbook Sysdig publishes is unglamorous and correct. Patch Langflow and never expose its code-execution endpoints to the internet. Store cloud keys and provider credentials in a secrets manager, kept away from any internet-reachable service. Change the default Nacos signing key, and keep Nacos itself off the public internet. Never expose a database administrator account to the internet. Lock down outbound traffic so a compromised host cannot beacon home on a 30-minute cron.

None of that is new advice. What is new is that failing to do it now hands a functioning enterprise breach to an autonomous system that can complete the entire kill chain before the on-call engineer finishes reading the first alert. For teams tracking this space, our AI Cybersecurity coverage and AI Safety reporting follow how detection tooling is adapting.

The Autonomous Ransomware Sysdig Case Study Sets a New Baseline

The autonomous ransomware Sysdig documented is not the end of the story. It is the first published sample. Two questions determine what the next twelve months look like.

The first is whether other incident response firms surface additional cases in the coming quarter. A single incident is a data point. Three or four independently investigated agentic ransomware operations against unrelated victims would confirm that the model has generalized outside one operator's setup. Sysdig's assessment stands or falls on corroboration that has not yet arrived.

The second is whether LLM providers can meaningfully constrain agents that use their APIs for this kind of work. Anthropic's November 2025 disclosure showed a vendor willing to name a state-linked actor abusing its tools. Whether the same visibility exists for a stolen-credential agentic ransomware operator remains an open question, and it is the one to watch through the rest of 2026.

The deadline that matters is short. Enterprises still running the unpatched Langflow CVE-2025-3248 exploit path have had since April 1, 2025 to fix it. Every day past today that a reachable, vulnerable Langflow instance stays online is a day the agentic ransomware attack chain runs itself.