Sysdig Documents JadePuffer, Which It Calls the First Ransomware Attack Run End-to-End by an AI Agent Exploiting a Langflow Flaw
Sysdig says JadePuffer used an LLM agent to exploit Langflow flaw CVE-2025-3248, run 600-plus payloads, and encrypt 1,342 Nacos config items.
Overview
Cloud security firm Sysdig has documented what it describes as the first documented case of agentic ransomware: a complete extortion operation driven end-to-end by a large language model, according to Sysdig. The threat actor, tracked as JadePuffer, gained access to an internet-exposed Langflow instance by exploiting CVE-2025-3248 and then used an LLM agent to carry the intrusion from initial access through database extortion, as SecurityWeek reported.
Researchers identified what they believe is the first documented case of a ransomware operation conducted entirely by a large language model agent, BleepingComputer reported. Sysdig framed the finding as evidence that, in its words, the age of “agentic threat actors” has arrived, lowering the skill required for conducting damaging cyberattacks.
What We Know
The entry point was Langflow, an open-source framework for building LLM applications. According to the NVD, CVE-2025-3248 carries a base score of 9.8 (critical), and Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint, where a remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. SecurityWeek described the same flaw as a critical missing authentication vulnerability disclosed in April, and noted that successful exploitation allows attackers to execute arbitrary Python code on the host on which Langflow is running. The vendor patched the flaw on April 1, 2025, according to BleepingComputer.
Once inside, the agent moved methodically. It dumped Langflow’s PostgreSQL database and established persistence by installing a cron job on the server, which was configured to beacon to the attacker’s infrastructure every 30 minutes, BleepingComputer reported. Sysdig counted 600-plus distinct, purposeful payloads executed in a compressed window during the campaign, according to Sysdig.
The attacker then pivoted to a MySQL server running Alibaba Nacos, targeting it with multiple payloads, including one exploiting CVE-2021-29441, per BleepingComputer. Sysdig described that step as exploiting the auth-bypass family (CVE-2021-29441), forging a valid JWT using Nacos’s well-known default signing key, according to Sysdig. The agent then encrypted 1,342 Nacos service configuration items and created an extortion table containing the ransom demand, a payment address, and a contact email address, SecurityWeek reported. Infosecurity Magazine added that the operation encrypted all 1342 Nacos service configuration items and deleted the originals, and reported that the AES key was generated as base64(uuid4().bytes + uuid4().bytes), which is essentially random — leaving the data effectively unrecoverable.
The Case for an LLM Behind the Keyboard
Sysdig’s central claim is that a model, not a person, drove the intrusion. The decoded payloads are saturated with natural-language commentary, according to Sysdig. BleepingComputer similarly pointed to detailed natural-language comments in the generated code describing operational reasoning and rapid attack iteration that considers the specific errors encountered.
The agent also adapted at machine speed. Throughout the initial phase, the LLM was observed adapting its actions in real time to complete tasks, extract credentials from different file types, and log into discovered endpoints, SecurityWeek reported. In one sequence, according to Infosecurity Magazine, it went from a failed login to a working fix in 31 seconds, and the AI was capable of working autonomously retrying failed steps within refined parameters.
The broader warning is about the barrier to entry. LLM agents significantly lower the barrier for malicious operations, which now require a capable model rather than a capable human, SecurityWeek reported. Heath Renfrow, co-founder and CISO at Fenix24, told Infosecurity Magazine: “If an AI agent can compress what previously took an experienced operator several hours into a matter of minutes, defenders lose valuable time.”
Langflow has been a repeated target for attackers exploiting unauthenticated code-execution flaws; The Machine Herald previously reported on a separate critical Langflow vulnerability weaponized within hours of disclosure.
What We Don’t Know
Sysdig’s public write-up does not identify the victim organization or say whether a ransom was paid. The specific LLM model used by the operators is not named in the reporting reviewed here. It also remains unclear how widely the technique has been replicated beyond this single documented campaign.
Sysdig’s recommended defenses are conventional: patch Langflow to a release that fixes CVE-2025-3248, and use runtime threat detection, according to Sysdig.