JADEPUFFER: An LLM Agent Just Ran a Complete Ransomware Attack

A few days ago, Sysdig's threat research team published their analysis of what they assess as the first fully autonomous LLM-driven ransomware attack. No human operator directed individual steps. An AI agent broke in, harvested credentials, moved laterally, encrypted a production database, destroyed the originals, and left a ransom note. The whole chain ran without a human at the keyboard.

The name Sysdig gave it: JADEPUFFER.

I want to walk through the attack chain, because the details matter more than the headline.

The Entry Point Was a Tool Builders Use

CVE-2025-3248 is an unauthenticated remote code execution flaw in Langflow, the visual builder for LLM workflows and agent applications. No login required. If Langflow is internet-facing and unpatched, anyone can POST arbitrary Python to an endpoint and it runs.

CISA added this to its Known Exploited Vulnerabilities catalog in May 2025. Fixed in Langflow 1.3.0. Apparently enough people were still running older versions that an attacker found a target.

This is the first thing that should land differently if you build AI systems. The entry point wasn't some obscure enterprise middleware. It was a tool that shows up in tutorials, in internal PoCs, in the early stages of agent projects. If you've got a Langflow instance running anywhere that isn't fully locked down, check the version right now.

The Attack Chain: Six Steps, 600+ Payloads

The agent sent more than 600 distinct Base64-encoded Python payloads through the Langflow RCE endpoint. Each was a separate, purposeful script. Here's how the chain ran:

1. Initial access via CVE-2025-3248. No credentials needed.
2. Reconnaissance: mapped directory structure, running services, internal network neighbors.
3. Credential harvest: swept the host for OpenAI, Anthropic, DeepSeek, and Gemini API keys, plus AWS, GCP, Azure, Alibaba, Tencent, and Huawei cloud credentials, database logins, and cryptocurrency wallet seed phrases.
4. Persistence: installed a crontab entry beaconing to a C2 server every 30 minutes.
5. Lateral movement: pivoted to a Nacos service registry on the internal network, attacking it simultaneously via CVE-2021-29441 (a 2021 Nacos auth bypass), a forged JWT using Nacos's well-known default signing key, and direct database injection to create a backdoor admin account.
6. Encryption and destruction: encrypted all 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT(), dropped the original schemas, and created a table named README_RANSOM with a Bitcoin address and contact email.

The agent ran this as a real-time loop. When something failed, it adapted.

The 31-Second Recovery Is the Telling Detail

Sysdig identified one moment that specifically evidences autonomy rather than a clever script: the agent created the backdoor Nacos admin account, attempted to log in, the login failed, the agent diagnosed what went wrong, and deployed a working fix. All of that happened in a 31-second window.

No human was directing that. The speed is the point. Humans can't read an error, form a hypothesis, generate corrective code, and deploy it in 31 seconds. A scripted playbook can't reason about novel failure modes. An LLM agent can do both.

Sysdig also noted that every decoded payload contained natural-language commentary explaining why each action was taken. Target prioritization framed as ROI analysis. The "largest" database identified and named. This is what LLM-generated attack code looks like: over-commented, reasoned, step-by-step.

The Cost to the Attacker Was Probably Zero

Here's the part that makes this structurally different from traditional ransomware. Step 3 in the chain harvested AI service API keys (OpenAI, Anthropic, DeepSeek, Gemini) before the rest of the attack ran. Sysdig's assessment is that the agent was likely running on stolen credentials through a technique called LLMjacking.

The practical implication: the attacker's compute cost is whatever it costs to find an unpatched Langflow instance. The victim pays the API bill. The skill floor for running a fully autonomous ransomware campaign has dropped to "can you write a prompt and find an exposed service."

That's a genuinely different threat model than what most security teams have been planning against.

The Decryption Key Doesn't Exist

This detail deserves its own paragraph.

The AES encryption key used to lock 1,342 database records was generated from two UUID4 calls. It was printed once to stdout and never persisted, never transmitted to the attacker. The attacker has no copy of it.

A victim who paid the ransom would receive nothing.

It's possible this is intentional (pure destruction framed as ransomware), or it's a bug in the agent's own execution. Either way, it shows that autonomous attack chains can fail in their own novel ways. The agent completed its mission as specified. The mission was badly specified.

What This Changes for Agent Infrastructure

I haven't run at the scale where this keeps me up at night yet, but the attack surface here is worth thinking through clearly.

If you're running any LLM tooling on an internet-facing host, the question isn't just whether the host itself is secure. The question is whether the AI tooling (Langflow, any visual agent builder, any MCP server endpoint) has its own authentication and network controls. Most agent tooling is built for local use and developer experience, not production network exposure. The defaults reflect that.

A few things I'm rethinking after reading Sysdig's report:

• Audit agent-adjacent services for exposed management endpoints. Langflow's /api/v1/run endpoint requires auth in 1.3.0+ but didn't before. Other tools follow similar patterns.
• Rotate API keys that could have been on a compromised host. JADEPUFFER targeted AI provider keys, cloud credentials, and database logins in a single sweep.
• Treat LLM API keys like database credentials, not CLI tokens. The threat model has changed.
• The Nacos JWT vector (forged using a well-known default signing key) is not new. CVE-2021-29441 is four years old. Patch and rotate.

The broader shift is that "agentic AI" is no longer just a product category. It's also an attack primitive. The same reasoning loop that makes an agent useful for autonomous task completion makes it effective at autonomous attack chains. The primitives are the same. The intent is what differs.