← Back to the blog

JadePuffer: the ransomware attack an AI agent ran itself (from breach to ransom note)

On 1 July 2026, the Sysdig Threat Research Team documented what it called the first confirmed case of agentic ransomware. It was a complete extortion operation in which the whole technical job - from the initial break-in to the ransom note - was run by a large language model (LLM) acting as an agent. The operator is tracked as JadePuffer. The motive was purely financial, with no link to known ransomware crews or any nation state. The goal was specific: databases and secrets.

Context and legality. This is educational material. We describe a publicly documented attack (Sysdig TRT) and the known, patched vulnerabilities it used. Testing systems you do not own is legal only with the owner's written authorisation. We explain the mechanism and the defence - we do not provide a ready-made exploit. One caveat up front: "agentic" does not mean "no human." We come back to that below.

What actually happened

The attack had two servers in its sights. The first was an internet-facing Langflow instance - a low-code tool for building LLM pipelines and agents. The second, the real target, was a production server running a MySQL database and an Alibaba Nacos configuration service. The agent came in through the first and did the destruction and extortion on the second.

Sysdig counted more than 600 distinct payloads delivered in a compressed window, each one base64-encoded Python executed through the Langflow RCE endpoint. This was not a single malware sample but a stream of commands generated and corrected on the fly.

Stage 1 - entry and secrets (Langflow, CVE-2025-3248)

The way in was an old acquaintance: CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint. An unauthenticated attacker can run arbitrary Python on the host. We took that same attack surface apart earlier in the Langflow chain; here it was simply the open door.

Once inside, the agent behaved like a methodical operator. It fingerprinted the host with ordinary commands (id, uname -a, hostname), then swept the environment for secrets:

• API keys for model providers - OpenAI, Anthropic, DeepSeek and Gemini - plus cloud credentials, with explicit coverage of Chinese providers,
• a dump of the Postgres database behind Langflow (credentials, keys, user records),
• an internal network and service scan, including the MinIO object store at 127.0.0.1:9000, which it logged into with the default minioadmin:minioadmin and pulled credentials.json from the terraform-state bucket.

Finally it set persistence: a crontab entry beaconing back to the attacker's infrastructure every 30 minutes.

Stage 2 - the pivot to Nacos and a bug fixed in 31 seconds

On the production server the agent went after Nacos using CVE-2021-29441, an authentication bypass that is four years old. It forged a valid JWT with Nacos's well-known default signing key and injected an administrator account straight into the service's database.

This is where the difference between a script and an agent shows most clearly. The insert did not work the first time, and the model dug itself out unaided:

19:34:24  inserts xadmin account (bcrypt hash) via subprocess
19:34:36  login attempt fails (12 s later)
19:35:07  diagnosis: bad PATH in the subprocess call
          → switches to a direct bcrypt import,
            deletes the broken row, reinserts the correct hash
19:35:18  login succeeds

The whole "spot the error, change approach, retry" loop closed in 31 seconds. The agent had no hard-coded handler for that specific failure. It read the message, inferred the cause and chose a different route, faster than a human at the keyboard would have.

Stage 3 - destruction and ransom

With access in hand, the agent encrypted all 1,342 Nacos configuration items using MySQL's built-in AES_ENCRYPT(), dropped the original config_info table and its history, and created a README_RANSOM table holding the demand. It simply DROPped several databases, leaving a code comment along the lines of "high-ROI databases to drop, data already copied to 64.20.53.230".

The note promised the victim decryption after a Bitcoin payment and claimed "AES-256" encryption. The catch: the agent generated the AES key as base64(uuid4().bytes + uuid4().bytes), printed it to standard output and never saved or transmitted it anywhere. In plain terms, even paying the ransom would leave nothing to decrypt with. On top of that, the Bitcoin address in the note is the canonical example from Bitcoin's own documentation, not a real operator wallet. Effective destruction, ineffective extortion - though for the victim it is the first part that counts.

Why this is new

Start with an honest bucket of cold water, because offensive work deserves it. No single technique here is new. An exposed service, credential theft, lateral movement, abuse of default passwords, dropping databases - that is a catalogue we have known for years. Johan Edholm of Detectify put it plainly: "more evolution than invention." What is new is something else: stitching the whole chain together without a human at every step.

Four things set JadePuffer apart from ordinary automation:

First, autonomous coordination. Classic malware runs a pre-written script. Here the model chained reconnaissance, key theft, the pivot, persistence and destruction, picking each next step from what it had just seen. The operator did not need expertise in any one stage.

Second, code that narrates its own intent. JadePuffer's payloads carried natural-language comments: reasoning, priorities, a rationale for each move. People rarely write like that under pressure; a model does it reflexively. That is both the strongest evidence an LLM was driving and, as we will see, a gift to defenders.

Third, real-time adaptation. The 31 seconds above were not a one-off. The agent also adjusted when it got the wrong data format or hit a database constraint. This is plan-act-observe-adjust behaviour, not a rigid script wrapped in try/except.

Fourth, old vulnerabilities at scale. The agent used a 2021 Nacos flaw. For a model, spraying the entire historical CVE catalogue is effectively free. Michael Clark of Sysdig captured it in one line: the skill floor for running a ransomware operation has dropped to "whatever it costs to run an agent."

Now the caveat we promised. JadePuffer was not hands-off. A human chose the victim, stood up the infrastructure (the C2 and the staging server for stolen data) and handed the agent root MySQL credentials taken in an earlier compromise. The model carried out the attack, but people aimed and armed it. The rough edges show it too: the placeholder Bitcoin address and the irrecoverable key mark an early, unpolished operation. So the fair summary is this: autonomous execution, human targeting. That is still enough to change the economics, because the most expensive part - hours of a skilled operator's time - just got cheap.

How to defend

In order of priority:

1. Close the entry. Patch Langflow (CVE-2025-3248) and keep code-execution endpoints off the public internet. Administrative access only behind a VPN or identity gateway.
2. Cut the secrets off from the agent. Do not keep cloud and model keys on the host where an agentic tool runs. Store secrets in a dedicated vault, injected at runtime; after any exposure, rotate every key.
3. Harden internal services. Patch Nacos (CVE-2021-29441) and change the default JWT signing key. Kill default passwords like minioadmin:minioadmin - those are exactly what the agent moved through.
4. Control egress and watch at runtime. Filter outbound traffic: blocking the 30-minute C2 beacon or the data push to the staging server breaks the chain. A quarterly assessment is not enough when an agent goes from discovery to impact in minutes. You need continuous visibility into what runs on your hosts.
5. Use the legible intent. The agent's payloads describe their own objectives in comments. Classic malware does not. That narrating text is a signal detection can catch.

What this means for organisations

JadePuffer is a case study of a broader shift: AI infrastructure is a new attack surface, and agentic tooling lowers the barrier to entry for attackers. For now this is a single, in places sloppy, incident. But as the tooling spreads and gets packaged into ready-made kits, it will reach less capable operators, and the volume and breadth of these campaigns will grow. Sysdig calls it a change in how extortion is carried out, and that reading looks right.

This maps straight onto NIS2/KSC: vulnerability management, supply-chain security, access control and incident detection. We covered the requirements in detail on the NIS2 / KSC page. If you build or host AI agents and want to test their resilience - from prompt injection through key abuse to secret leakage - that is exactly our specialisation: AI / LLM red teaming. Book a consultation if you want to check your own attack surface before someone else's agent does it for you.

Sources: Sysdig (original report) · CyberScoop · TechCrunch · Dark Reading · BleepingComputer