A cyberattack documented by cloud security firm Sysdig in early July 2026 marks the first confirmed case of ransomware run end-to-end by an AI agent — and it comes with a twist that changes the threat model entirely: the encryption key was generated once, printed to a log, and never stored or transmitted. Paying would have returned nothing. The ransom note was theater. What JADEPUFFER actually ran was a data-destruction operation wearing a ransomware costume.
On July 1, 2026, Sysdig’s Threat Research Team published findings on a threat actor it named JADEPUFFER, documenting what researchers assess is the first end-to-end agentic ransomware operation: a large language model drove reconnaissance, credential theft, lateral movement, privilege escalation, encryption, and ransom-note delivery without a human operator steering each step. Sysdig’s JADEPUFFER threat research Michael Clark, Director of Threat Research at Sysdig, told CyberScoop that a human still provisioned the infrastructure and chose the victim — but the AI handled every technical decision after that, adapting to failures in real time.
The two things are both true: this was the first documented autonomous AI ransomware operation, and it was not fully autonomous. Understanding the difference determines whether your defensive posture is calibrated to the actual threat.
How an AI Agent Chained Old Bugs Into a Complete Attack
The attack began with an unpatched server.
JADEPUFFER’s entry point was CVE-2025-3248, a critical vulnerability in Langflow, an open-source Python framework widely used to build AI agent workflows and LLM-powered applications. The flaw — missing authentication in Langflow’s code validation endpoint — allows any unauthenticated attacker to send a crafted HTTP POST request and execute arbitrary Python code on the host. Langflow patched it on March 31, 2025, in version 1.3.0. Langflow version 1.3.0 release CISA added it to its Known Exploited Vulnerabilities catalog on May 5, 2025. CISA Known Exploited Vulnerabilities catalog The targeted server had never been updated — more than a year after the patch existed and was flagged as actively exploited.
That entry point made Langflow servers especially valuable. Because AI orchestration tools routinely hold API keys for OpenAI, Anthropic, DeepSeek, Google Gemini, and cloud providers including AWS, Azure, GCP, Alibaba, and Tencent in their environment, a compromised Langflow instance is also a credential vault. JADEPUFFER swept the environment systematically: dumping Langflow’s internal PostgreSQL database, scanning for secrets in environment variables and configuration files, and enumerating a MinIO object storage server using factory-default credentials — minioadmin:minioadmin — that had never been changed.
The agent also established persistence: a scheduled cron job that beaconed to attacker-controlled infrastructure every 30 minutes, ensuring a way back in regardless of what followed.
Langflow was never the real target. Artifacts from the compromised host showed the operation’s true objective was a separate, internet-facing production server running a MySQL database and Alibaba Nacos — a service-registry and dynamic-configuration platform common in microservice architectures. Nacos has a documented authentication bypass vulnerability from 2021 (CVE-2021-29441) and ships with a default JWT signing key that has been publicly known since 2020 and remains unchanged in many deployments. JADEPUFFER exploited both simultaneously alongside its root database access to inject a backdoor administrator account directly into the Nacos backing database.
The LLM did not run a static script against these targets. When an initial attempt to create a Nacos administrator account failed because a subprocess PATH issue prevented the bcrypt library from generating a valid hash, the agent read the error, diagnosed the root cause, deleted the broken account, switched from subprocess calls to a direct bcrypt library import, verified the fix, and redeployed a corrected payload. The interval between failure and working fix: 31 seconds. No human operator responds and retests in 31 seconds.
Across the full operation, the agent fired more than 600 distinct, coordinated payloads. Every one was annotated with plain-language comments explaining its own purpose — target prioritization, database ROI analysis, step-by-step rationale. That self-narrating style is the tell: human attackers writing disposable one-liner exploits don’t annotate their own intentions. Language models do it by default.
The Ransom Note Was Theater: Why This Was Always a Wiper Attack
The final phase was not ransomware in any functional sense.
JADEPUFFER encrypted all 1,342 Nacos service configuration items using MySQL’s built-in AES_ENCRYPT() function, then dropped the original tables and created an extortion table named README_RANSOM containing a Bitcoin wallet address and a ProtonMail contact address. The ransom note claimed the data had been backed up to a staging server. Sysdig found no evidence that any exfiltration occurred.
More critically: the AES encryption key was generated as a random 256-bit value derived from two UUID4 calls, printed once to standard output, and never persisted or transmitted anywhere. The attacker has no copy of the key. A victim who paid the ransom demand would receive nothing in return — there is nothing to hand over.
This is the same functional category as NotPetya, the 2017 cyberattack that caused an estimated $10 billion in damage. NotPetya used encryption as cover for data destruction; its design made decryption structurally impossible regardless of payment. JADEPUFFER instantiates the same pattern using an agentic AI architecture. Whether this was intentional (the attacker knew the key was ephemeral and simply wanted destruction) or a design error (the LLM implemented encryption without considering key persistence) is unknown. Sysdig cannot identify which model drove the operation, cannot access its system prompt or configuration, and has no visibility into whether the missing key persistence was a deliberate choice.
The Bitcoin wallet address in the ransom note — an address that matches a well-known Bitcoin documentation example — raises a second possibility: the LLM may have hallucinated the address from training data, meaning any payment would go to a random third party rather than the attacker. Sysdig cannot rule this out.
The recovery path for the victim is not “pay the ransom.” It is immutable backups and a tested restoration procedure. Organizations without those have no options.
What a Human Still Did — and Why It Matters
The “fully autonomous” framing that led initial coverage of JADEPUFFER overstates what actually happened, and the overstating matters beyond semantics.
Clark told CyberScoop: “A human still set up and pointed the operation and provisioned the infrastructure behind it — the command-and-control server, the staging server, and chose a victim.” The root credentials the agent used to access the production MySQL server were not harvested from the victim’s environment; they came from a prior compromise whose specifics Sysdig could not determine, and were presumably provided to the operation before it began.
The AI drove every technical decision after setup: which services to probe, how to authenticate, how to diagnose failures, how to pivot, and when to encrypt. Microsoft researcher Geoff McDonald, writing on LinkedIn, theorized the model was likely an open-weight model with safety training stripped out — a theory consistent with the agent’s willingness to issue destructive commands, and one Sysdig neither confirms nor rules out.
The gap between “fully autonomous ransomware” and “ransomware with an autonomous technical execution phase” is not pedantry. It shapes how the industry responds and what defenses get prioritized. Johan Edholm, co-founder of security firm Detectify, told Dark Reading the attack is “more evolution than invention.” What’s remarkable is not the techniques — credential theft, lateral movement, default credentials, database destruction are all familiar — but that an AI model chained them into a complete operation without a skilled operator at the wheel of each step.
The operational consequence is sharper than the framing debate suggests. Roey Eliyahu, CEO of Salt Security, identified the structural root cause: “The Langflow server was not the target. It was a machine identity governance problem — AI-adjacent infrastructure accumulated credentials that nobody actively monitored or rotated.”
How AI Agent Architecture Made This Possible
JADEPUFFER ran on what researchers call a ReAct (Reason and Act) loop — the same architectural pattern behind every commercial AI agent tool deployed in enterprise environments today. The pattern works like this: the model receives the result of each action, reasons about what it reveals, generates the next action, executes it, and repeats. When an action fails, the model incorporates the failure into its next reasoning step and adjusts.
That is exactly what happened with the Nacos backdoor. The agent received a login failure, reasoned about the error message, identified a PATH issue with the bcrypt subprocess call, switched to a direct library import, and produced a working fix. The same adaptive loop governed the MinIO enumeration: when a JSON-formatted request returned XML, the next payload switched parsers. When a DROP DATABASE command failed silently due to a foreign key constraint, the next payload wrapped the command with SET GLOBAL FOREIGN_KEY_CHECKS=0 before the drop. Every failure produced a specific diagnostic, not a blind retry.
This architecture is not exotic. It is the same mechanism running inside enterprise automation workflows, AI coding assistants, and security operations platforms. JADEPUFFER did not use a novel AI capability — it used the standard ReAct capability that every LLM provider has been shipping for two years, pointed at a target with an unpatched server and unchanged default credentials.
The LLM’s self-narrating payloads create a detection opportunity that human-written malware typically does not: the model’s verbose comments explaining its own reasoning are legible to defenders. Sysdig notes this is one of four detection characteristics that distinguish LLM-generated payloads from human-written ones. Signature-based defenses scanning for known malware patterns will miss it. Behavioral detection — flagging the pattern of sequential database reconnaissance, credential harvesting, and multi-vector authentication attempts at machine speed — is what can catch it.
How to Know If Your Organization Is in the Risk Window
JADEPUFFER did not use zero-days or novel techniques. It walked through doors that were left open. All of the following represent actionable exposure if present in your environment:
Patch Langflow to 1.3.0 or later immediately. CVE-2025-3248 was fixed in March 2025 and flagged by CISA as actively exploited over a year ago. If your organization runs any internet-facing Langflow deployment on a version prior to 1.3.0, treat it as compromised until verified otherwise. Ben Ronallo, principal cybersecurity engineer at Black Duck, warned that investigators should not stop at the Langflow host — the production database server was the actual target, so every system reachable from the compromised host needs to be mapped.
Keep AI tooling credentials isolated. Langflow servers are high-value targets specifically because they routinely hold API keys for cloud services and AI providers in their environment. Those credentials belong in a dedicated secrets manager, isolated from any internet-facing application. Roey Eliyahu’s framing is precise: this is a machine identity governance problem. AI infrastructure that accumulates credentials without monitoring or rotation is a credential vault waiting to be emptied.
Change MinIO’s default credentials. The minioadmin:minioadmin default has been documented as an attack surface for years. Any internet-reachable MinIO deployment with unchanged defaults is an invitation.
Harden Nacos and remove it from internet exposure. Change the default token.secret.key (publicly known since 2020), disable or restrict CVE-2021-29441’s attack surface by upgrading to a version that requires authentication, and ensure the service is never directly reachable from the public internet. Database root access from Nacos should be scoped and restricted.
Invest in behavioral detection over signature detection. JADEPUFFER’s attack produced no known malware signature — every payload was generated at runtime by the LLM. Heath Renfrow, co-founder and CISO at breach recovery firm Fenix24, put it directly: “If an AI agent can compress what previously took an experienced operator several hours into a matter of minutes, defenders lose valuable time. That has implications across every phase of an incident — from detection and containment to recovery.”
Maintain immutable backups with tested restoration. The JADEPUFFER victim cannot recover their data regardless of whether they pay. The only resilient posture for this class of attack is backups that cannot be reached and altered by a compromised application server, with restoration procedures validated before an incident occurs.
An Economy of Destruction
The Flashpoint 2026 Global Threat Intelligence Report documented a 1,500 percent surge in AI-related illicit activity. Malwarebytes predicted at the start of 2026 that autonomous ransomware pipelines would mature during the year and allow individual operators to attack multiple targets simultaneously at a scale exceeding anything the ransomware ecosystem had previously produced. JADEPUFFER, documented in late June 2026, validates that prediction.
Michael Clark framed it precisely: “The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero.”
Edholm identified what follows from that: early adopters of agentic ransomware will be operators who already know how to connect models to offensive infrastructure. As those tools become packaged and reusable, they spread to less capable operators. Criminal organizations are not constrained by procurement cycles or compliance requirements when adopting new technology.
The infrastructure that made JADEPUFFER possible — unpatched servers, secrets in reachable environments, default credentials, internet-exposed database management interfaces — is present in organizations around the world. The AI crossed a threshold. The door it walked through was left open by the humans who did not close it.
Frequently Asked Questions
Can victims recover data encrypted by JADEPUFFER, even by paying the ransom?
No. Sysdig confirmed that the AES encryption key was randomly generated and printed once to a log file, but never stored or transmitted to the attacker’s infrastructure. There is no key for an attacker to hand over, regardless of payment. The only realistic recovery path is restoring from immutable backups that were not accessible from the compromised environment. Organizations without tested backups have no recovery options for the 1,342 configuration items that were encrypted and then deleted.
Was JADEPUFFER truly a fully autonomous AI attack, with no human involvement?
Not entirely. Sysdig’s Michael Clark clarified to CyberScoop that a human still provisioned the command-and-control infrastructure, chose the victim, and supplied the MySQL root credentials the agent used to access the production database. Those credentials were not harvested by the AI — they came from a prior compromise. What the AI handled was every technical decision after setup: which services to probe, how to authenticate, how to diagnose and recover from failures, and when and how to encrypt. The human picked the target and loaded the weapon; the AI pulled the trigger and adapted when it misfired. That distinction matters for how organizations calibrate their defensive response — the threat is a skilled human operator reduced to an infrastructure provisioner, not a fully machine-origin attack with no human in the chain.
How do I know if my organization is at risk from agentic ransomware like JADEPUFFER?
The exposure surface JADEPUFFER exploited consists of well-known, fixable misconfigurations: any internet-facing Langflow deployment running a version prior to 1.3.0 remains vulnerable to CVE-2025-3248; any Nacos deployment using the default JWT signing key is susceptible to JWT forgery; any MinIO instance with unchanged minioadmin:minioadmin credentials is an open vault; and any production database accepting root-level connections from internet-reachable hosts is a direct destruction target. Organizations running AI orchestration tooling should audit what credentials their AI infrastructure holds, whether those deployments are network-isolated, and whether behavioral detection is in place to flag sequential reconnaissance at machine speed — the one signal JADEPUFFER’s approach reliably generates. Sysdig’s IoC and defensive guidance
What made JADEPUFFER identifiably AI-driven rather than a human-scripted attack?
Sysdig cited four independent indicators. First, the payloads were self-narrating — saturated with natural-language comments explaining the agent’s own targeting rationale and step-by-step logic, a style no human operator writes in disposable one-liner exploits but that language models produce by default. Second, the failure-to-fix cycle operated at machine speed: diagnosing a failed login, identifying the root cause as a subprocess PATH issue, switching to a direct library import, and redeploying a corrected payload in 31 seconds. Third, the agent adapted its parsing logic mid-operation when an API returned XML instead of expected JSON — a specific, contextual adjustment rather than a retry of the same failed command. Fourth, the agent’s failure handling throughout was specific to each failure mode rather than generic — the foreign key constraint error produced a targeted SET GLOBAL FOREIGN_KEY_CHECKS=0 fix, not a blind retry.
