Researchers at Sysdig have documented what appears to be the first end-to-end ransomware operation conducted entirely by an AI agent, a significant escalation in how cybercriminals are automating attacks. The threat actor, dubbed JADEPUFFER, exploited a vulnerability in Langflow to gain initial access, then used an autonomous AI agent to steal credentials, move laterally, escalate privileges, and encrypt databases without human intervention.

The operation encrypted 1,342 Nacos service configuration items before deleting the originals. What sets this attack apart is not just its automation, but the AI agent’s adaptive behavior. When steps failed, the agent retried with refined parameters. In one sequence, it recovered from a failed login to a working exploit in 31 seconds—the kind of real-time problem-solving that used to require a human operator.

How the Attack Unfolded

JADEPUFFER gained entry through CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, a popular open-source framework for building LLM applications. From there, the agent pivoted to a production MySQL server running Alibaba Nacos, using root credentials whose origin Sysdig couldn’t determine.

The encrypted data—service configurations—are critical to how organizations manage their infrastructure. Attackers could demand ransom by threatening to publish or permanently corrupt them. Sysdig’s analysis shows the agent didn’t just execute a script. It adapted, retried, and recovered from obstacles with a level of flexibility that resembles human reasoning.

Why This Matters for Security Teams

The JADEPUFFER discovery signals a turning point. Ransomware automation has existed for years, but this is the first documented case where an LLM agent handled reconnaissance, lateral movement, privilege escalation, and data exfiltration end-to-end without a human orchestrating each step.

Security teams now face a new threat model. Traditional defenses that rely on detecting suspicious patterns may miss agentic ransomware because the AI adapts its approach. A failed exploit attempt doesn’t stop the attack—it triggers a retry with adjusted parameters. This requires not just faster detection, but smarter detection systems that can identify when an AI is learning from failure.

Organizations should urgently patch Langflow instances, review access logs for suspicious pivots from development to production systems, and expect security budgets for AI threat detection to climb fast.

FYI

What is Langflow and why does it matter to my organization?

Langflow is an open-source visual framework for building applications powered by large language models. It’s popular among developers because it simplifies LLM integration. If your organization uses Langflow in development or production, CVE-2025-3248 is a critical risk—it allows unauthenticated attackers to run code on your server.