INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Jadepuffer AI Agent Automates Entire Attack

| 2026-07-04 14:16 CRITICAL MEDIUM AI-ENABLED ATTACK · AUTONOMOUS
JSON
Executive Summary
AI-generated
The JadePuffer ransomware attack has demonstrated the potential of AI agents to automate complex cyber operations, exploiting vulnerabilities and gathering sensitive information with unprecedented ease. This autonomous agent used a large language model to steal credentials, move laterally, establish persistence, escalate privileges, and encrypt data, ultimately demanding a Bitcoin payment in exchange for the decryption key. The attackers' ability to adapt their tactics based on cloud security company Sysdig's analysis of the Langflow instance highlights the adaptive nature of modern AI agents.
Technical Mitigations AI-generated
* Implement a robust vulnerability scanning and remediation process to identify and fix potential weaknesses before they can be exploited by attackers. * Use AI-powered security tools that can detect and adapt to the behavior of ransomware operations, such as cloud security companies like Sysdig or SentinelOne. * Regularly update and patch software applications, frameworks, and libraries used in development projects to prevent exploitation of known vulnerabilities. * Conduct regular penetration testing and vulnerability assessments to identify potential entry points for attackers and strengthen defenses against AI-powered attacks.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
64.20.•••.•••
cr•••••.json
AI Podcast (EN) detail_available
detail_listen_ai (EN)
Intelligence distributed on:
Incident Link
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation SysdigOperation Sysdig CVE-2025-3248CVE-2025-3248 CVE-2021-29441CVE-2021-29441
Target & Sectors
CN
Incident Timeline
‎April 1, 2025
Threat actors used a previously unknown vulnerability in the API to target internet-exposed endpoints.
attribution API
The vendor fixed the flaw on April 1, 2025, and in early May of the same year, CISA tagged it as exploited in attacks targeting internet-exposed endpoints, usually deployed with minimal hardening but containing cloud credentials and API keys.
‎May 2025
Threat actors used a known vulnerability in Langflow 1.3.0 to target CISA's Known Exploited Vulnerabilities list in May 2025.
attribution CISA’s Known Exploited
Langflow was patched and added to CISA’s Known Exploited Vulnerabilities list in May 2025.
tactic T1588.006 - Vulnerabilities
Langflow was patched and added to CISA’s Known Exploited Vulnerabilities list in May 2025.
The flaw was fixed in Langflow 1.3.0 and added to CISA's Known Exploited Vulnerabilities list in May 2025, but plenty of servers were never updated.
infrastructure 1.3.0
The flaw was fixed in Langflow 1.3.0 and added to CISA's Known Exploited Vulnerabilities list in May 2025, but plenty of servers were never updated.
‎August 2025
Researchers at ESET discovered PromptLock, billed as the first AI-powered ransomware.
tactic Ransomware
In August 2025, researchers at ESET flagged  PromptLock , billed as the first AI-powered ransomware; it later turned out to be a lab  prototype from NYU  called Ransomware 3.0, not a real attack.
organisation ESET
In August 2025, researchers at ESET flagged  PromptLock , billed as the first AI-powered ransomware; it later turned out to be a lab  prototype from NYU  called Ransomware 3.0, not a real attack.
organisation NYU
In August 2025, researchers at ESET flagged  PromptLock , billed as the first AI-powered ransomware; it later turned out to be a lab  prototype from NYU  called Ransomware 3.0, not a real attack.
financial 3.0 Ransomware
In August 2025, researchers at ESET flagged  PromptLock , billed as the first AI-powered ransomware; it later turned out to be a lab  prototype from NYU  called Ransomware 3.0, not a real attack.
‎November 2025
China's state-linked espionage group Anthropic launched a cyberattack using Claude, an AI tool designed to steal data without human assistance.
source_region China
In November 2025, Anthropic disclosed what it called the  first largely autonomous cyberattack , a Chinese state-linked spying effort that had Claude write exploits and steal data with little human help.
‎2026/07/04
Threat actors used LLM-generated payloads to target JADEPUFFER, a first end-to-end AI-driven ransomware operation.
‎2026/07/04
JADEPUFFER exploited CVE-2025-3248 in Langflow, an open-source tool for AI apps and agent workflows.
organisation JadePuffer
JadePuffer ransomware used AI agent to automate entire attack.
The operator, which Sysdig calls JADEPUFFER, broke into a server, harvested credentials, moved to a separate production target, encrypted a database, and destroyed data, all without a human at the keyboard.
Once inside, the agent (JADEPUFFER) listed system details, searched for API keys and cloud credentials, dumped Langflow’s Postgres data, checked reachable internal services, and probed MinIO storage using default credentials.
JADEPUFFER exploited  CVE-2025-3248 , a missing-authentication flaw in  Langflow , an open-source tool for building AI apps and agent workflows.
organisation Sysdig’s Threat Research Team
Sysdig’s Threat Research Team has documented what it assesses to be the first ransomware operation driven end-to-end by a large language model.
organisation Ransomware
Ransomware has always needed a skilled person somewhere in the loop.
Ransomware has always needed a skilled person somewhere in the loop, either at the keyboard or writing the script the malware follows.
organisation TRT
“The Sysdig Threat Research Team (TRT) has captured what we assess to be the first documented case of agentic ransomware: a complete extortion operation driven end-to-end by a large language model (LLM).”
organisation Automate Database Ransomware Attack
AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack.
organisation Sysdig
The operator, which Sysdig calls JADEPUFFER, broke into a server, harvested credentials, moved to a separate production target, encrypted a database, and destroyed data, all without a human at the keyboard.
In its blog post , Sysdig noted that the key appeared to be printed once and not saved or sent, meaning payment would not have restored the encrypted configurations.
Sysdig says that is the agent talking, not something the team could confirm, and found no evidence that any data was actually left.
organisation API
Once inside, the agent (JADEPUFFER) listed system details, searched for API keys and cloud credentials, dumped Langflow’s Postgres data, checked reachable internal services, and probed MinIO storage using default credentials.
Sysdig highlights the adaptive approach to MinIO enumeration, where if one API request returned XML instead of JSON, the next payload adjusted its parsing logic accordingly.
Langflow boxes are attractive because they tend to sit exposed on the internet and frequently hold API keys and cloud credentials for the services they connect to.
Langflow boxes are a tempting target because they often sit exposed on the internet and hold API keys and cloud credentials for the services they connect to.
organisation Langflow’s Postgres
Once inside, the agent (JADEPUFFER) listed system details, searched for API keys and cloud credentials, dumped Langflow’s Postgres data, checked reachable internal services, and probed MinIO storage using default credentials.
organisation CVE-2025
JADEPUFFER exploited  CVE-2025-3248 , a missing-authentication flaw in  Langflow , an open-source tool for building AI apps and agent workflows.
“This operator, which we have dubbed JADEPUFFER, gained initial access to an internet-facing Langflow instance through  CVE-2025-3248  and ran an adaptive and fully automated campaign, ultimately pivoting to the intended target and running a destructive database-extortion playbook against the victim’s production database server.
The entry point was CVE-2025-3248 , a missing authentication flaw in Langflow’s code validation endpoint that lets a remote unauthenticated attacker execute arbitrary code on affected hosts, with NVD rating the flaw 9.8 critical under CVSS 3.1.
victims 17 organizations
Around the same time, Anthropic reported a real  extortion campaign  that used its Claude Code tool to hit  at least 17 organizations , with demands topping $500,000, though a human still steered that one.
financial $500,000 demands
Around the same time, Anthropic reported a real  extortion campaign  that used its Claude Code tool to hit  at least 17 organizations , with demands topping $500,000, though a human still steered that one.
organisation Nacos
JADEPUFFER encrypted 1,342 Nacos configuration items using MySQL’s AES_ENCRYPT function, dropped the original configuration and history tables, and created a README_RANSOM table containing a Bitcoin address and Proton Mail contact.
The Ransom Note With No Key The agent encrypted all 1,342 Nacos settings, dropped the original tables, and left a ransom note demanding Bitcoin with a Proton Mail contact.
Nacos is a service-discovery and dynamic configuration platform common in microservice architectures.
organisation MySQL’s AES_ENCRYPT
JADEPUFFER encrypted 1,342 Nacos configuration items using MySQL’s AES_ENCRYPT function, dropped the original configuration and history tables, and created a README_RANSOM table containing a Bitcoin address and Proton Mail contact.
organisation CVE-2025-3248
From initial access to encryption JadePuffer gained initial access to the target by exploiting CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, a popular open-source framework used for building LLM apps.
organisation NVD
The entry point was CVE-2025-3248 , a missing authentication flaw in Langflow’s code validation endpoint that lets a remote unauthenticated attacker execute arbitrary code on affected hosts, with NVD rating the flaw 9.8 critical under CVSS 3.1.
organisation Langflow
Sysdig's published indicators for this operation include: Entry point: CVE-2025-3248 (Langflow unauthenticated remote code execution)
It also raided Langflow’s own backing Postgres database, harvesting stored credentials, API keys, and user records, staged the output to local files, reviewed them, then deleted the staging files.
Ronallo said companies with exposed Langflow systems should activate incident response, patch immediately, and review logs for Sysdig’s indicators of compromise.
organisation CVE-2021-29441
From there, it attacked Nacos through multiple vectors simultaneously: exploiting the 2021 authentication bypass CVE-2021-29441, forging a valid JWT using the well-known default signing key, and injecting a backdoor administrator account directly into the Nacos backing database.
organisation XML
Sysdig highlights the adaptive approach to MinIO enumeration, where if one API request returned XML instead of JSON, the next payload adjusted its parsing logic accordingly.
When an initial request using ?format=json received XML in response, the LLM immediately adapted its parser to the S3 response schema and re-issued the request.
organisation LLM
When an initial request using ?format=json received XML in response, the LLM immediately adapted its parser to the S3 response schema and re-issued the request.
The Bitcoin address listed in the ransom note is an example address widely used in public documentation, possibly the result of the LLM reproducing it from the training data.
The LLM agent abused a Langflow flaw, harvested credentials, reached a production database, and destroyed Nacos configuration data.
organisation Naming and Configuration Service
From the Langflow instance, the attacker pivoted to a production MySQL server running Alibaba Nacos (Naming and Configuration Service), using root credentials whose origin Sysdig couldn’t determine.
organisation EDR
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
organisation GetObject
“It also escalated progressively: anonymous health check → admin API info → authenticated  ListBuckets  → targeted  GetObject  on files whose names suggested credentials ( credentials.json ,  .env ).”
organisation Huawei
Immediately after gaining execution, it swept the environment for secrets across multiple categories in parallel: API keys for OpenAI, Anthropic, DeepSeek, and Gemini; cloud credentials including Chinese providers like Alibaba, Aliyun, Tencent, and Huawei alongside AWS, GCP, and Azure; cryptocurrency wallet keys and seed phrases; and database credentials and configuration files.
organisation AWS
Immediately after gaining execution, it swept the environment for secrets across multiple categories in parallel: API keys for OpenAI, Anthropic, DeepSeek, and Gemini; cloud credentials including Chinese providers like Alibaba, Aliyun, Tencent, and Huawei alongside AWS, GCP, and Azure; cryptocurrency wallet keys and seed phrases; and database credentials and configuration files.
It mapped the machine, then swept it for secrets: API keys for AI services (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials (Chinese providers like Alibaba and Tencent alongside AWS, Google, and Azure), crypto wallet keys, and database logins.
organisation GCP
Immediately after gaining execution, it swept the environment for secrets across multiple categories in parallel: API keys for OpenAI, Anthropic, DeepSeek, and Gemini; cloud credentials including Chinese providers like Alibaba, Aliyun, Tencent, and Huawei alongside AWS, GCP, and Azure; cryptocurrency wallet keys and seed phrases; and database credentials and configuration files.
organisation Alibaba and Tencent
It mapped the machine, then swept it for secrets: API keys for AI services (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials (Chinese providers like Alibaba and Tencent alongside AWS, Google, and Azure), crypto wallet keys, and database logins.
organisation Google
It mapped the machine, then swept it for secrets: API keys for AI services (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials (Chinese providers like Alibaba and Tencent alongside AWS, Google, and Azure), crypto wallet keys, and database logins.
organisation Postgres
It also raided Langflow’s own backing Postgres database, harvesting stored credentials, API keys, and user records, staged the output to local files, reviewed them, then deleted the staging files.
organisation Ronallo
Ronallo said companies with exposed Langflow systems should activate incident response, patch immediately, and review logs for Sysdig’s indicators of compromise.
organisation S3
MinIO is a self-hosted, S3-compatible storage service widely used to hold application data, backups, machine learning models, and infrastructure state.
organisation JWT
Its authentication system has a documented history of bypasses, and its default JWT signing key has been publicly known since 2020 and ships unchanged in many deployments.
organisation PATH
Thirty-one seconds later, without any human intervention, a corrective payload appeared: it deleted the broken account, diagnosed the root cause as a subprocess PATH issue preventing bcrypt from generating a valid hash, switched to importing bcrypt directly, confirmed the library was importable by printing its version, and reinserted the account with a correctly generated hash.
organisation BTC
It is also a real, active wallet with 737 confirmed transactions and roughly 46 BTC received over its history, with every deposit immediately transferred elsewhere and the current balance at zero.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, JADEPUFFER)
organisation the Sysdig Threat Research Team
Researchers at the Sysdig Threat Research Team named the operator JADEPUFFER and described it as an agentic threat actor, meaning the attack execution came from an AI agent , not a human-controlled toolkit.
organisation IP
Sysdig said it found no evidence that any data was actually backed up to that IP, which appeared only during the mass-destruction stage.
organisation Shane Barney
Shane Barney , chief information security officer at Keeper Security, said the case should be read less as science fiction and more as a credential failure at machine speed.
organisation Keeper Security
Shane Barney , chief information security officer at Keeper Security, said the case should be read less as science fiction and more as a credential failure at machine speed.
organisation Black Duck
Ben Ronallo , principal cybersecurity engineer at Black Duck, said the Langflow flaw was public long before this campaign, making patch visibility and execution the first order of business.
organisation Its Threat Research Team
Its Threat Research Team calls the operator JADEPUFFER and says a large language model handled the whole job: breaking in, stealing credentials, moving deeper into the network, then encrypting and wiping a company's production database.
organisation AES-256
(The note claims AES-256; Sysdig notes the tool it used defaults to weaker AES-128, though the result is the same.)
Tactical Metrics
Metrics
financial
3
Ransomware
In August 2025, researchers at ESET flagged  PromptLock , billed as the first AI-powered ransomware; it later turned out to be a lab  prototype from NYU  called Ransomware 3.0, not a real attack.
Metrics
victims
17
Organizations
Around the same time, Anthropic reported a real  extortion campaign  that used its Claude Code tool to hit  at least 17 organizations , with demands topping $500,000, though a human still steered that one.
Metrics
financial
500,000
Demands
Around the same time, Anthropic reported a real  extortion campaign  that used its Claude Code tool to hit  at least 17 organizations , with demands topping $500,000, though a human still steered that one.
Metrics
infrastructure
‎1.3.0
Software Version
The flaw was fixed in Langflow 1.3.0 and added to CISA's Known Exploited Vulnerabilities list in May 2025, but plenty of servers were never updated.
Intelligence Sources
BleepingComputer 2026-07-04
Security Affairs 2026-07-03
HackRead 2026-07-02
The Hacker News 2026-07-02