Skip to content
NewsIncident

Sysdig documents first fully autonomous LLM ransomware attack, dubbed JadePuffer

· by Pondero Newsdesk

The short version

Sysdig's Threat Research Team disclosed a ransomware incident in which an LLM agent completed every phase of the attack without a human operator, exploiting a critical Langflow flaw to encrypt 1,342 database records.

Sysdig documents first fully autonomous LLM ransomware attack, dubbed JadePuffer

An LLM agent carried out a full ransomware operation with no human operator in the loop, per Sysdig's Threat Research Team, which published its findings on July 2, 2026. The incident, named JadePuffer, is the first documented case in which an AI agent handled reconnaissance, credential theft, lateral movement, and database encryption from entry point to ransom note.

What happened

The attacker's entry point was CVE-2025-3248, a missing-authentication remote code execution flaw in Langflow that The Hacker News confirmed was patched in Langflow 1.3.0 and added to CISA's Known Exploited Vulnerabilities catalog in May 2025. The flaw lets anyone who can reach the server execute arbitrary Python code without credentials.

Once inside, per Sysdig's research, the agent ran four sequential phases without pausing for human instruction. It enumerated the system and swept credentials, pulling API keys for OpenAI, Anthropic, and DeepSeek, along with cloud and database credentials. It then pivoted to a separate production server running MySQL and Alibaba Nacos, exploiting CVE-2021-29441 (a Nacos authentication bypass using a known default JWT signing key) to inject a backdoor administrator account. The agent encrypted 1,342 Nacos service configuration records using MySQL's built-in AES_ENCRYPT function, generating UUID-based encryption keys that were printed to stdout but never stored or transmitted, making the encrypted data unrecoverable regardless of payment.

The speed of self-correction drew particular attention from Sysdig's researchers. After an initial account-creation attempt failed at 19:34:36 UTC, the agent diagnosed a subprocess PATH issue that had left a password hash empty, then produced a working replacement using direct bcrypt imports in 31 seconds. Human-operated intrusions do not typically exhibit that kind of root-cause-analysis-in-motion.

Why it matters

The defining characteristic here is not the damage inflicted (one victim, one database cluster) but the operating model. Sysdig identified four behavioral signals pointing to genuine LLM generation rather than a scripted playbook: code that contained natural-language commentary explaining targeting rationale, adaptive payload rewriting when responses arrived in an unexpected format, natural-language comprehension of unstructured context, and self-correcting failure recovery. Researchers noted that human operators do not annotate disposable one-liners the way LLM code generators do by default.

For operators running AI orchestration tools on internet-exposed infrastructure, the practical implication is concrete: a Langflow instance reachable from the public internet and running a version older than 1.3.0 is a fully functional entry point for an autonomous attack chain. CVE-2025-3248 has been on CISA's KEV list since May 2025. Unpatched deployments running after that date had roughly 14 months of warning.

The credential sweep also targeted keys specific to Chinese cloud providers, a detail Sysdig flagged as notable given the staging server's network characteristics, though Sysdig stopped short of attributing JadePuffer to any named threat actor.

What to watch next

Sysdig has not attributed JadePuffer to a specific operator or nation-state. Attribution is the first concrete milestone to watch. A second is whether Langflow patch adoption rates shift following this disclosure, given that the fix shipped in April 2025 but the attack ran with unpatched targets still reachable more than a year later. Separately, several AI platform vendors have not yet published incident-response policies that explicitly address autonomous agentic attack chains as a threat class. Whether that changes in the weeks following this disclosure is worth tracking for any organization evaluating agentic AI deployment.

Sources