Sysdig's Threat Research Team on July 1, 2026 published the first documented case of a fully AI-agent-driven ransomware operation, dubbed JadePuffer. Director of Threat Research Michael Clark reports that an autonomous LLM agent — not a human operator — executed every phase of the attack, from initial exploitation to extortion, against an internet-exposed Langflow instance.
Key Highlights
- Initial access via CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow, the popular open-source LLM app builder.
- The agent encrypted 1,342 configuration items inside an Alibaba Nacos server using MySQL's
AES_ENCRYPT(), then dropped the originals. - The encryption key was printed once to stdout and never persisted — victims cannot recover data even after paying.
- When a backdoor account insertion failed, the agent generated a working corrective payload in 31 seconds, without human intervention.
- Sysdig's takeaway: "The skill floor for running ransomware has dropped to whatever it costs to run an agent."
Details
The intrusion started with a missing-authentication bug on Langflow's code-validation endpoint. Once the agent got Python execution on the LLM orchestration server, it enumerated the host, dumped the backing PostgreSQL database, and harvested API keys for OpenAI, Anthropic, DeepSeek, and Gemini, plus cloud credentials for Alibaba, Aliyun, Tencent, and Huawei.
From the compromised Langflow box, the agent pivoted to a MinIO object store (default credentials minioadmin:minioadmin), read a terraform-state bucket, and pulled the production credentials.json. It then reached the target: an internet-exposed Nacos configuration service.
Using CVE-2021-29441 (Nacos auth-bypass) with the documented default JWT signing key, the agent forged an admin token and tried to inject a backdoor account directly into the database. The first insertion failed because the bcrypt hash was generated via a broken subprocess call. Within 31 seconds, the agent diagnosed the PATH issue, deleted the broken record, re-hashed with a direct Python bcrypt import, and logged in successfully.
Sysdig noted that a human triaging this same error, drafting a fix, and redeploying would typically take minutes to hours — not half a minute. Payloads also contained self-narrating comments explaining "why" each action was taken, plus ROI-style commentary like "High-ROI databases to drop" — signatures characteristic of LLM-generated code.
Impact
For DevOps and platform teams, the operational picture just changed. Individual techniques in JadePuffer — Langflow RCE, Nacos JWT bypass, MinIO default credentials — are not novel. What is new is the integration: an autonomous agent that reasons across the kill chain, adapts to errors in seconds, and never sleeps.
Two consequences for engineering teams building on LLM tooling:
- AI orchestration servers are now high-value targets. They typically hold provider API keys, cloud credentials, and vector store secrets. A single Langflow, Flowise, or n8n instance exposed to the internet is enough to seed a full extortion chain.
- Neglected default configurations amplify blast radius. MinIO with
minioadmin:minioadmin, Nacos with the defaulttoken.secret.key, and unpatched RCEs from prior years remain the fastest path in — even for agents.
The ransom demand went to a Bitcoin address that matches the canonical Pay-to-Script-Hash documentation example seen across LLM training data — Sysdig cannot fully rule out that the agent hallucinated the wallet rather than being handed one by an operator.
Background
Langflow is a widely adopted visual builder for LangChain-based LLM apps, popular with engineering teams prototyping agent workflows. CVE-2025-3248, disclosed earlier in 2025 and added to CISA's Known Exploited Vulnerabilities catalog, allows arbitrary Python execution on unauthenticated endpoints — a class of bug the security industry has warned about repeatedly on AI dev tools.
Recent months have seen mounting evidence that offensive AI agents are moving from research demos to real incidents. The Anthropic Threat Intelligence report earlier in 2026 flagged agentic extortion patterns; Socket Security's TrapDoor campaign showed AI assistants being co-opted via .cursorrules and CLAUDE.md files. JadePuffer is the first case where the agent itself is the intruder end-to-end.
What's Next
Sysdig's defensive checklist is now the baseline for anyone running LLM orchestration in production: patch CVE-2025-3248, remove provider API keys and cloud credentials from AI-orchestration server environments, isolate code-execution endpoints from the internet, enforce non-default Nacos signing keys, and add egress controls that block compromised hosts from reaching external databases or staging servers.
Expect similar cases to accelerate. As Sysdig puts it, this is not about a single novel exploit — it is about the collapsing cost of stringing old bugs together at machine speed. Teams shipping AI agents into production should assume attackers are shipping them too.
Source: Sysdig — JADEPUFFER: Agentic ransomware for automated database extortion