Cybersecurity firm Sysdig says it has documented the first known ransomware attack carried out end-to-end by an AI agent.
The threat actor, which Sysdig calls JADEPUFFER, did not rely on a human operator at every step. Instead, the attack used an LLM-driven agent to exploit a vulnerable Langflow server, harvest credentials, move deeper into the environment, encrypt a production database, and leave a ransom note.
That matters because the individual techniques were not new. The bigger concern is that an AI agent chained them together at machine speed.
What Happened?
JADEPUFFER gained initial access through CVE-2025-3248, a critical Langflow vulnerability that allows unauthenticated remote code execution. Langflow is an open-source framework used to build AI applications and agent workflows, which makes exposed servers especially risky when they hold API keys, cloud credentials, or database access.
According to Sysdig, the attack started with Base64-encoded Python payloads sent through the vulnerable Langflow endpoint. Once inside, the agent mapped the host, checked running services, searched for secrets, and dumped Langflow’s backing database.
It looked for AI provider keys, cloud credentials, cryptocurrency wallets, database logins, and configuration files. It also probed internal services, including MinIO object storage, and created persistence through a scheduled task that contacted the attacker’s command-and-control server every 30 minutes.
From there, JADEPUFFER pivoted to a production database server running MySQL and Alibaba’s Nacos configuration service. The agent used root database access, abused older Nacos authentication weaknesses, forged access using a default signing key, and created a backdoor administrator account.
Why Researchers Believe AI Was Driving the Attack
Sysdig points to several signs that the operation was LLM-driven. The payloads contained plain-English comments that explained the attacker’s goals and next steps. The agent also adapted when something failed. In one example, it moved from a failed login to a working multi-step fix in 31 seconds.
That behavior matters. A normal script can retry a failed command, but this attack diagnosed specific errors and changed tactics. Sysdig also counted more than 600 purposeful payloads across the operation, which supports its assessment that an autonomous agent drove the attack rather than a fixed toolkit.
See also: Anthropic Redeploys Claude Fable 5 After US Export Controls Are Lifted
The Ransomware Part Was Destructive
JADEPUFFER encrypted 1,342 Nacos configuration items and created a ransom table named README_RANSOM. However, this was not a normal recoverable ransomware case.
Sysdig says the encryption key was randomly generated, printed once, and never stored or sent to the attacker. In other words, the victim could not recover the encrypted configurations even if it paid.
The ransom note also claimed data had been backed up to a staging server, but Sysdig says it did not verify that exfiltration happened. That detail is important because the agent’s own comments may have overstated what it actually did.
Why This Attack Matters
The alarming part is not that JADEPUFFER used a new zero-day or a highly advanced exploit chain. It did not. The entry point was an already-patched Langflow flaw. The later steps leaned on weak credentials, exposed services, default keys, old vulnerabilities, and poor segmentation.
That is the real warning. AI agents can automate the boring but dangerous parts of intrusion work: scanning, testing credentials, reading errors, changing payloads, and chaining small weaknesses together. This lowers the skill floor for ransomware operators and raises the pressure on defenders.
For businesses, developers, and homelab users running AI tools, the lesson is clear: do not expose experimental AI infrastructure to the internet unless you have a strong reason and proper controls.
Recommended reading: GPT-5.6 Sol vs Terra vs Luna: What’s the Difference and Which Should You Use?
How to Reduce the Risk
Patch Langflow immediately, especially any version before 1.3.0. CVE-2025-3248 is a critical unauthenticated RCE, and CISA added it to its Known Exploited Vulnerabilities catalog in 2025.
Do not place AI orchestration tools, dev dashboards, databases, or configuration services directly on the public internet. Put them behind VPNs, private networks, access controls, and source-IP restrictions.
Remove default credentials from MinIO, Nacos, databases, and other internal services. Rotate secrets stored in AI development environments, and avoid placing cloud keys or AI provider keys in web-reachable processes.
Harden Nacos by changing the default token signing key, upgrading to a safer release, and preventing it from connecting to its database as root.
Add egress controls so a compromised server cannot freely beacon to an external command-and-control address. Monitor for scheduled tasks, abnormal Python execution, database encryption activity, and unusual outbound connections.
Trending topic: Samsung, SK Hynix and Micron Face Class Action Lawsuit Over Alleged DRAM Price Fixing
Bottom Line
JADEPUFFER is not a sign that every ransomware attack will instantly become fully autonomous. But it does show where ransomware is heading.
Attackers no longer need to invent new techniques if an AI agent can combine old ones quickly and cheaply. Exposed AI tools, forgotten dev servers, default credentials, and unpatched services now carry even more risk.
For PC enthusiasts, developers, small businesses, and anyone running homelabs or cloud apps, this is the part to take seriously: AI does not need a perfect exploit to cause damage. It only needs one exposed weak point and enough permissions to move.
Source: sysdig
