Researchers have identified JadePuffer as the first documented ransomware operation entirely executed by a large language model (LLM) agent. This AI agent autonomously conducted the attack, performing reconnaissance, stealing credentials, and encrypting data. It exploited a remote code execution vulnerability (CVE-2025-3248) in the Langflow framework, adapting its methods in real-time to bypass obstacles. JadePuffer managed to encrypt 1,342 configuration items using AES encryption, establishing a structured ransom note. The incident illustrates the emergence of 'agentic threat actors' (ATAs), indicating a new era in cyberattacks where AI significantly lowers the skill barrier for launching sophisticated ransomware operations.

Home
News
Security
JadePuffer ransomware used AI agent to automate entire attack

JadePuffer ransomware used AI agent to automate entire attack

Bill Toulas

July 4, 2026
10:16 AM
0

Researchers identified what they believe is the first documented case of a ransomware operation, JadePuffer, conducted entirely by a large language model (LLM) agent.

According to cloud security company Sysdig, JadePuffer used an autonomous AI agent for reconnaissance on the target, to steal credentials, move laterally, establish persistence, escalate privileges, and to encrypt data.

The researchers say that the AI agent adapted to failures during the intrusion, much like a human operator would handle obstacles.

“The operation also adapted in real time, retrying failed steps within refined parameters. In one sequence, it went from a failed login to a working fix in 31 seconds,” Sysdig says.

From initial access to encryption

JadePuffer gained initial access to the target by exploiting CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, a popular open-source framework used for building LLM apps.

The vendor fixed the flaw on April 1, 2025, and in early May of the same year, CISA tagged it as exploited in attacks targeting internet-exposed endpoints, usually deployed with minimal hardening but containing cloud credentials and API keys.

After obtaining code execution through CVE-2025-3248, the AI agent dumped Langflow's PostgreSQL database, collected host information, searched for environment variables and sensitive files, retrieved credentials, and enumerated a MinIO object store.

Sysdig highlights the adaptive approach to MinIO enumeration, where if one API request returned XML instead of JSON, the next payload adjusted its parsing logic accordingly.

JadePuffer also established persistence on the Langflow host by installing a cron job on the server, which was configured to beacon to the attacker’s infrastructure every 30 minutes.

From the Langflow instance, the attacker pivoted to a production MySQL server running Alibaba Nacos (Naming and Configuration Service), using root credentials whose origin Sysdig couldn’t determine.

Nacos was targeted with multiple payloads, including one exploiting CVE-2021-29441, an authentication bypass vulnerability that creates rogue administrator accounts.

The agent probed for container escape methods and deployed the ransomware payload. According to the researchers, JadePuffer encrypted 1,342 Nacos service configuration items before deleting the originals.

“The captured payloads show the agent encrypting all 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT(), dropping the original config_info and history tables, and creating an extortion table (README_RANSOM) containing the demand, a Bitcoin payment address, and a Proton Mail contact,” describes Sysdig.

The encryption function

Source: Sysdig

The ransom note claims that the data was encrypted using the AES-256 algorithm, although the researchers believe this to be an overstatement, and that the use of the weaker AES-128-ECB is more likely.

Sysdig mentions that the encryption key is randomly generated but not stored or transmitted to the attacker.

The Bitcoin address listed in the ransom note is an example address widely used in public documentation, possibly the result of the LLM reproducing it from the training data.

Other signs that AI was controlling the attack include detailed natural-language comments in the generated code describing operational reasoning and rapid attack iteration that considers the specific errors encountered, rather than being simple retries.

Rapid iteration steps

Source: Sysdig

Sysdig concludes that the case of JadePuffer demonstrates that the age of “agentic threat actors” (ATAs) has arrived, lowering the skill required for conducting damaging cyberattacks.

At the same time, given how AI agents operate today, LLM-generated payloads create new detection opportunities for security solutions.

Test every layer before attackers do

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

OpenClaw AI agent found falling for phishing attacks, spills user data

New BioShocking attack manipulates AI browser into data theft

Clean GitHub repo tricks AI coding agents into running malware

Microsoft fixes AutoGen Studio flaw that enabled code execution

Every AI Agent Is an Identity. Most Organizations Don't Treat Them That Way

Photo of Bill Toulas

Bill Toulas Email bill.toulas@bleepingcomputer.com Open Author's twitter page

Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.