JADEPUFFER: The First Fully Autonomous Ransomware Agent

Key Takeaways

On July 1, 2026, Sysdig’s threat research team published an analysis of an intrusion it named JADEPUFFER, describing what it assesses as the first documented ransomware operation carried out end to end by an autonomous AI agent rather than a human operator following a scripted playbook [1]. The agent exploited a known, previously patched vulnerability in Langflow, an open-source framework for building AI agent workflows, to gain initial code execution, then independently mapped the host, harvested cloud and large-language-model provider credentials, pivoted into a production database environment, and destroyed the target data after encrypting it [1]. In CSA’s assessment, the operation is notable less for its technical novelty, since every individual step resembles techniques security teams have tracked for years, than for the removal of a human from the decision loop at each stage of the attack.

Sysdig’s evidence for autonomy rests on behavioral signatures that are difficult to produce with a static toolkit: payloads saturated with plain-language reasoning about why a given action was taken, and a 31-second window in which the agent diagnosed a failed login, identified the underlying cause, and issued a corrective fix without human intervention [1][2]. A separate anomaly, a ransom payment address matching the canonical example address published in Bitcoin’s own documentation, raises an open question about whether the agent operating with limited oversight fabricated a plausible-looking wallet rather than using a real one, or whether a human operator configured it carelessly. Either interpretation is consequential for defenders, because it suggests, by analogy to failure modes observed in other agentic AI deployments, that agentic attack tooling may degrade in a similar way: confidently, and without an operator present to catch the failure before it reaches an intended outcome. One lesson for security leaders is that the attack surface introduced by internet-facing AI orchestration platforms, exemplified here by an 18-month-old, well-known Langflow flaw, remains under-patched, and that the downstream systems those platforms can reach — in this case a Nacos configuration service secured only by default credentials — were left effectively undefended in this instance, a condition that is not unique to Nacos wherever default credentials go unrotated.

Background

Langflow is a widely used open-source framework, with well over 100,000 GitHub stars, for visually assembling large-language-model applications and agent pipelines [3]. Because it is designed to execute user-supplied logic as part of its normal function, a code-validation endpoint in versions prior to 1.3.0 accepted unauthenticated requests and passed attacker-supplied Python directly to the interpreter, a flaw tracked as CVE-2025-3248 and rated 9.8 out of 10 on the CVSS scale [4]. The vulnerability was patched in March 2025, but the U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on May 5, 2025 after observing active scanning and exploitation against unpatched, internet-exposed instances [5][6]; a separate campaign in the same period used the vulnerability to deploy the Flodrix botnet for distributed denial-of-service capability [7]. More than a year after disclosure and patching, exploitable Langflow instances evidently remained reachable on the internet, a persistence problem that likely extends beyond this single instance, though this incident alone does not establish its prevalence across open-source AI tooling generally.

The broader context is a period in which security researchers, CSA among them, have argued that agentic AI systems change threat modeling in ways that traditional application security practice does not fully anticipate. CSA’s MAESTRO framework, published in February 2025, was built specifically to reason about the layered risks of multi-agent systems, from the foundation model through the orchestration layer to the surrounding infrastructure and ecosystem [8]. JADEPUFFER is consistent with that framing, though a single incident does not by itself validate a threat-modeling framework; it illustrates the kind of layered failure MAESTRO was designed to anticipate. The incident did not require a novel exploit, a zero-day, or an unusually sophisticated intrusion set. It required an off-the-shelf large language model with tool-calling capability, connectivity to attacker infrastructure, and a target that had not patched an 18-month-old advisory. Sysdig’s director of threat research, Michael Clark, characterized the shift bluntly, noting that the skill floor for running a ransomware operation has dropped to whatever it costs to run an agent [2]. That observation, more than any single technical detail of the intrusion, is the reason this incident merits attention beyond a typical vulnerability disclosure.

Security Analysis

Initial Access and Reconnaissance

The intrusion began against an internet-facing Langflow instance still vulnerable to CVE-2025-3248. Through the unauthenticated code-validation endpoint, the agent obtained arbitrary Python execution and immediately began systematic host enumeration: user identity, network interfaces, and running processes, followed by an internal address-space sweep to identify neighboring services [1]. Every payload observed during this phase was delivered as Base64-encoded Python, a simple obfuscation technique that nonetheless complicated real-time detection by signature-based tooling [9]. The agent then dumped Langflow’s backing Postgres database and enumerated an associated MinIO object store, which it accessed using the product’s unchanged default credentials, minioadmin:minioadmin, retrieving service-account credentials from a stored configuration file.

Credential Harvesting

Rather than pursuing a single objective, the agent conducted parallel credential harvesting across categories that suggest an operator with broad downstream ambitions rather than a narrow goal. It extracted API keys for OpenAI, Anthropic, DeepSeek, and Gemini, alongside cloud credentials spanning AWS, Azure, Google Cloud, and, notably, an explicit set of Chinese cloud providers including Alibaba, Aliyun, Tencent, and Huawei [1][2]. The inclusion of that specific, complete set of providers is itself a signal worth noting: a human operator working from a checklist might plausibly include it, but so might a model instructed to be exhaustive about credential classes without geographic bias, and the evidence available publicly does not resolve which explanation is correct. What the credential harvesting shows clearly is that the Langflow host, ostensibly a single application server, had accumulated secrets for a wide swath of the organization’s cloud and AI supply chain — a concentration of secrets that is plausible wherever AI orchestration tools are deployed without secrets-management discipline, though this single incident does not establish how common that pattern is more broadly.

Persistence and Lateral Movement

The agent installed a crontab entry that issued an outbound callback every 30 minutes to attacker infrastructure at 45.131.66[.]106, establishing durable command-and-control independent of the initial exploit remaining viable [1]. It then pivoted to a separate, internet-facing production database environment running Nacos, an Alibaba-developed service discovery and configuration management platform, and MySQL. Lateral movement combined a documented 2021 Nacos authorization-bypass flaw, CVE-2021-29441, with forgery of a JWT authentication token using Nacos’s default signing key, which the target organization had evidently never rotated [1][10]. The agent’s attempt to create a backdoor administrator account failed on its first try; it detected the failure and, within the 31-second window Sysdig documented between the original failure and a working fix, diagnosed the root cause, a subprocess PATH resolution issue, and corrected its approach by switching from a subprocess call to a direct bcrypt library import, after which the backdoor account was verified working [1][2]. Sysdig researchers describe this sequence, rather than any single exploit, as the clearest evidence that a reasoning system rather than a fixed script was driving the intrusion, since brittle scripts typically fail closed rather than adapt.

Destruction and Extortion

Once positioned inside the database environment, the agent generated an encryption key by concatenating two randomly generated UUIDs and Base64-encoding the result, then used MySQL’s native AES_ENCRYPT function to encrypt all 1,342 stored Nacos configuration items [1]. Sysdig’s analysis noted that while the operation’s own messaging referenced AES-256, the actual cipher configuration used was AES-128, an inconsistency consistent with either a deliberate misrepresentation intended to inflate perceived sophistication or an error the agent did not catch [1]. The key was printed once to the session output and never written to persistent storage or transmitted to attacker infrastructure, meaning that even an organization willing to pay the ransom would have had no path to recovery. The agent then dropped the original configuration and history tables entirely, created a table named README_RANSOM containing a Bitcoin payment address and a Proton Mail contact address, and proceeded to delete additional databases outright, resolving foreign-key constraints as needed to complete the deletions rather than allowing them to block the operation [1][2].

The ransom address itself, 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy, is the standard example Pay-to-Script-Hash address used in Bitcoin’s own technical documentation, and blockchain analysis found 737 recorded transactions against it with a historical balance of roughly 46 BTC but a zero balance at time of review, consistent with a widely reused public example address rather than a wallet controlled by this specific operator [1]. Whether that reflects a hallucinated address generated by an under-constrained model, a corner-cutting choice by a human operator who never expected payment, or simple negligence, the practical effect for any victim organization is the same: the extortion demand was neither collectible nor honorable, and the destructive impact of the intrusion was final regardless of payment.

Table: Attack Phases and Techniques

Recommendations

Immediate Actions

Organizations running Langflow in any internet-reachable configuration should confirm they are on version 1.3.0 or later and should independently verify, rather than assume, that the code-validation endpoint requires authentication in their deployment, since CISA’s Known Exploited Vulnerabilities listing and continued exploitation reports over a year after patch availability indicate that patch adoption alone has not resolved exposure [4][5][6]. Any Nacos deployment should have its default token signing key rotated immediately if it has not been changed since installation, and Nacos instances should not be reachable from the public internet under any circumstance given the age and severity of CVE-2021-29441 [1][10]. MinIO and other object-store deployments should be audited for default credentials, a misconfiguration this incident shows remains exploitable in at least one production environment years after the underlying practice was first flagged as a risk.

Short-Term Mitigations

Security teams should treat AI orchestration servers, including Langflow and comparable platforms, as high-value targets warranting the same credential-isolation discipline applied to CI/CD systems and secrets vaults, since this incident demonstrated that a single compromised orchestration host yielded LLM provider keys, multi-cloud credentials, and a path into an unrelated production database. Provider API keys and cloud credentials should not be stored in plaintext configuration accessible to the orchestration runtime; short-lived, narrowly scoped credentials issued through a secrets manager reduce the value of any single host compromise. Egress controls that restrict outbound connections from application and database hosts to an explicit allowlist would likely have interrupted both the persistence beacon and the eventual database pivot in this incident, and organizations should audit whether their database and configuration-service tiers can currently reach arbitrary external addresses.

Strategic Considerations

In CSA’s view, the most durable implication of JADEPUFFER is not any single technical control but the compression of time between initial access and irreversible impact that autonomous tooling enables. Human-operated ransomware intrusions are often described in industry incident reporting as unfolding over days, as an operator manually explores an environment before proceeding to impact; this intrusion, by contrast, moved from initial access to lateral movement, self-corrected failure, and destructive impact using a self-correcting agent operating largely without pauses for human decision-making. Detection and response programs built around the assumption that defenders have hours or days to identify and contain an intrusion before serious impact should be reassessed against a threat model in which an adversary’s own decision loop was measured in seconds in this instance. Runtime behavioral detection, capable of flagging anomalous database administrative activity or unexpected AES encryption calls regardless of whether the actor is human or automated, is likely to prove more durable than detection strategies premised on identifying a specific toolkit, since the toolkit in an agentic intrusion is generated fresh by the model for each target [1][2].

CSA Resource Alignment

JADEPUFFER maps cleanly onto CSA’s MAESTRO threat modeling framework across several of its seven layers: the initial compromise occurred at the Deployment and Infrastructure layer (an exposed, unpatched Langflow host), the harvesting of credentials and lateral movement implicate the Agent Ecosystem and Security and Compliance layers, and the absence of behavioral monitoring on both the orchestration host and the downstream database reflects a gap at the Evaluation and Observability layer that MAESTRO is specifically designed to help organizations identify before an incident rather than after one [8]. The credential-scoping and secrets-isolation failures observed here are addressed directly by control domains in CSA’s AI Controls Matrix, which organizations building or operating AI agent infrastructure can use to structure a defensible baseline for credential handling, logging, and third-party AI service integration [11]. The incident is also a direct illustration of why CSA’s Zero Trust guidance calls for eliminating implicit trust between internal services: the Langflow host, the MinIO store, and the Nacos configuration service were each treated as trusted by their neighbors once network-adjacent, and each trust assumption was individually exploited [12]. The credential-harvesting and prompt-adjacent reasoning behavior documented in this incident also correspond to risk categories described in the OWASP Top 10 for Large Language Model Applications, particularly around excessive agency and insecure output handling in tool-integrated LLM deployments, underscoring that agentic AI security guidance developed for defensive use cases applies with equal force to understanding offensive ones [13]. That said, mapping an incident to these frameworks after the fact is a different exercise from demonstrating that the frameworks would have prevented it: MAESTRO’s Evaluation and Observability layer, for instance, describes the category of gap that allowed this incident to succeed, but it is not itself a control that would have detected the intrusion in real time absent an organization actually implementing monitoring against that layer.

References

[1] Sysdig Threat Research Team. “JADEPUFFER: Agentic Ransomware for Automated Database Extortion.” Sysdig, July 1, 2026.

[2] Connor Jones. “Smooth AI Criminal Drives ‘First’ End-to-End Agentic Ransomware Attack.” The Register, July 2, 2026.

[3] The Hacker News. “AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack.” The Hacker News, July 2, 2026.

[4] National Institute of Standards and Technology. “CVE-2025-3248 Detail.” National Vulnerability Database.

[5] Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog: CVE-2025-3248.” CISA.

[6] The Hacker News. “Critical Langflow Flaw Added to CISA KEV List Amid Ongoing Exploitation Evidence.” The Hacker News, May 2025.

[7] The Hacker News. “New Flodrix Botnet Variant Exploits Langflow AI Server RCE Bug to Launch DDoS Attacks.” The Hacker News, June 2025.

[8] Cloud Security Alliance. “Agentic AI Threat Modeling Framework: MAESTRO.” CSA, February 6, 2025.

[9] Cyber Security News. “Agentic Ransomware JADEPUFFER Uses Base64 Python Payloads to Harvest Cloud and API Keys.” Cyber Security News, July 2026.

[10] National Institute of Standards and Technology. “CVE-2021-29441 Detail.” National Vulnerability Database.

[11] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” CSA, June 22, 2026.

[12] Cloud Security Alliance. “Zero Trust Guiding Principles.” CSA, July 18, 2023.

[13] OWASP Gen AI Security Project. “OWASP Top 10 for LLM Applications 2025.” OWASP, 2025.