Security researchers at cloud security firm Sysdig have published findings on JadePuffer, what they describe as the world’s first confirmed fully autonomous, agentic ransomware operation — a cyberattack carried out from initial access to data extortion entirely without human guidance, driven by a large language model acting as the operator’s autonomous agent.
What Happened
The threat actor behind JadePuffer gained initial access by exploiting CVE-2025-3248, a critical unauthenticated remote code execution vulnerability in Langflow — an open-source platform used to build AI agent workflows. Langflow’s vendor patched the flaw in April 2025, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue in May 2025. Despite the patch being publicly available for over a year, the targeted Langflow instance remained unpatched and internet-exposed — a common and costly configuration error.
What made the JadePuffer attack fundamentally different from prior ransomware incidents was not the entry point but what happened after it. Rather than a human operator manually directing the attack, an LLM-powered AI agent took over — autonomously conducting reconnaissance on the compromised system, dumping Langflow’s PostgreSQL database, collecting host configuration information, searching for environment variables and sensitive credential files, and enumerating a connected MinIO object storage instance. The agent established persistence by installing a cron job configured to beacon every 30 minutes to attacker-controlled infrastructure.
How the Attack Unfolded
From the Langflow instance, the AI agent pivoted to a production MySQL server running Alibaba’s Nacos — a naming and configuration service used in distributed environments. The agent then executed a ransomware payload with precision: it encrypted 1,342 Nacos service configuration items using MySQL’s native AES_ENCRYPT() function, dropped the original config_info and history tables, and created a new table named README_RANSOM containing the extortion demand, a Bitcoin wallet address for payment, and a Proton Mail contact address.
What makes Sysdig’s analysis particularly alarming is the agent’s documented adaptability. When it encountered failures at certain stages — a characteristic challenge for automated systems — it modified its approach, much as a skilled human penetration tester would pivot in real time. The entire attack chain, from initial access through data destruction, was carried out without a human operator intervening at any step.
Why It Matters
JadePuffer represents a threshold event in cybersecurity. For most of ransomware’s history, sophisticated multi-stage attacks — involving lateral movement, privilege escalation, persistence establishment, and targeted data destruction — required attackers with substantial technical expertise and hours or days of hands-on operational work. That expertise acted as a meaningful brake on the frequency and scale of attacks: there were only so many skilled human operators in the world.
JadePuffer suggests that brake is loosening. An LLM agent can now chain together reconnaissance, credential theft, lateral movement, persistence, and destruction without the operator needing deep expertise in any individual step. As AI agent platforms become more capable and more widely accessible, the barrier to executing sophisticated end-to-end attacks is collapsing. The same technological advances enabling enterprise AI deployment at scale are simultaneously equipping threat actors with capabilities that were previously out of reach.
Defenders face a fundamental asymmetry: AI-augmented attackers can operate at machine speed and scale across thousands of targets simultaneously, while most security operations centers still rely heavily on human analysis and response. That gap is the central security challenge posed by agentic AI.
Background and Context
Langflow is an increasingly popular tool for building multi-step AI agent workflows, widely used by developers experimenting with LLM-powered automation. Its growth reflects a broader explosion in the deployment of autonomous AI systems — the same ecosystem that is producing frontier-level AI models from a growing number of providers worldwide. As more AI infrastructure gets exposed to the internet with minimal security controls, it creates a growing attack surface that sophisticated threat actors are actively mapping and targeting.
Prior to JadePuffer, researchers had demonstrated agentic AI capabilities in controlled laboratory settings. Proof-of-concept work showed LLMs could autonomously exploit known vulnerabilities and chain together attack steps when given the right tools and prompting. JadePuffer is the first incident documented in a real-world production environment against an actual victim, crossing the line from academic demonstration to confirmed operational deployment.
Critical Perspectives
Some cybersecurity analysts have cautioned against overstating the novelty of JadePuffer. The underlying CVE it exploited was a known, patched vulnerability — the kind of basic hygiene failure that has enabled ransomware attacks for years. The autonomous execution, while significant, may not materially change the threat landscape for organizations that already maintain good patch management practices and limit internet exposure of administrative tools.
Sysdig’s own researchers acknowledge uncertainty about the attack’s full scope: they could not determine the source of the MySQL root credentials used to pivot to the Nacos server, leaving a gap in the attack chain’s reconstruction. This is a meaningful caveat — the agent’s capability may have been partly dependent on a human operator having previously staged credentials or done preparatory work that is not visible in the telemetry.
What Comes Next
The JadePuffer incident is likely the first of many. As LLM capabilities continue to advance and agentic AI tools become easier to deploy and customize, the friction of building autonomous attack pipelines will continue to decline. Security teams are being advised to prioritize patching internet-exposed AI platforms, treat LLM infrastructure with the same exposure controls applied to other sensitive administrative systems, and begin investing in detection capabilities specifically tuned for the behavioral signatures of autonomous agent activity — which may look different from traditional human-driven intrusion patterns. The window in which these defenses can be built before agentic attacks become routine is narrowing.
