Cloud security firm Sysdig says it has captured the first documented case of ransomware run start to finish by an AI agent, with no human operator typing commands, fixing bugs, or deciding when to pull the trigger.
The operator, which Sysdig’s Threat Research Team named JadePuffer, broke into an internet-facing Langflow instance through CVE-2025-3248, a missing-authentication flaw that lets an unauthenticated attacker run arbitrary Python on the host. From there it harvested credentials, moved laterally to a separate production server, and ran a destructive extortion playbook against that server’s MySQL and Nacos configuration service. Sysdig calls this category of adversary an “agentic threat actor,” meaning the attack capability itself comes from an LLM rather than a fixed toolkit or a skilled human behind the keyboard.
Langflow is an open-source framework for building LLM applications and agent workflows, which makes it an ideal foothold: instances often sit exposed on the internet, get stood up quickly without network controls, and hold provider API keys and cloud credentials in their environment. Once inside, JadePuffer listed system details, searched for API keys and cloud credentials (with explicit targeting of Alibaba, Aliyun, Tencent, and Huawei alongside AWS, GCP, and Azure), dumped the instance’s Postgres database, and probed a MinIO object store using default credentials. It then installed a crontab entry to beacon back to attacker infrastructure every 30 minutes, giving itself persistence on the Langflow host before ever touching its real target.
That real target was a separate production server running MySQL and Alibaba’s Nacos service-discovery platform. JadePuffer connected using root credentials whose origin Sysdig could not trace, then attacked Nacos through CVE-2021-29441, a years-old authentication bypass, and by forging a JSON web token with Nacos’s default signing key, which has been publicly known since 2020. Using its database access, the agent injected a rogue administrator account into Nacos, encrypted all 1,342 service configuration items with MySQL’s built-in AES_ENCRYPT function, dropped the original configuration and history tables, and left behind a ransom table with a Bitcoin address and a Proton Mail contact.
None of these individual techniques are novel. What makes JadePuffer notable is a single 31-second sequence. When the agent’s first attempt to create a Nacos administrator account failed because of a malformed credential hash, it diagnosed the failure, regenerated the hash using a different method, recreated the account, and verified a successful login, all within 31 seconds. That is not blind retry-until-it-works brute forcing; it is closer to what a competent human operator does when a script breaks, compressed into a timeframe no human could match.
Sysdig also found something the agent apparently didn’t intend to reveal: the AES encryption key was generated from two concatenated UUID4 values, printed once to output, and never saved or exfiltrated anywhere. That means even a victim who paid the ransom would have no way to recover the data. The agent had no persistent memory and no built-in exfiltration step for the one artifact that would have made the extortion demand credible.
Throughout the operation, JadePuffer’s payloads carried extensive natural-language comments explaining what each block of code was doing and why, a habit LLMs fall into reflexively that human attackers rarely bother with. Researchers note this is a double-edged discovery: it gives defenders a genuinely new detection signal, since a self-narrating payload is easier to flag than a terse human-written script, but it also means the agent’s own claims inside the code, including a comment asserting that data had been backed up to a specific IP address, can’t be taken at face value. Sysdig found no evidence any backup to that address ever occurred.
The core implication researchers are drawing out is about the skill floor, not the skill ceiling. Chaining reconnaissance, credential theft, lateral movement, persistence, and destructive extortion together used to require either a capable individual or a coordinated crew. JadePuffer suggests that chain can now be run by anyone able to point an LLM agent at exposed infrastructure, and if that agent is operating on stolen API credentials through LLMjacking, the marginal cost of running the attack approaches zero.
It also compresses the defender’s timeline. A human operator debugging a failed exploit might lose minutes or hours; JadePuffer lost 31 seconds. Security teams who assume they have a window between initial compromise and serious damage should treat that window as shrinking toward machine speed rather than human speed.
Every entry point in this case traces back to ordinary, well-known hygiene failures: an unpatched year-old CVE, default credentials left unchanged, a signing key never rotated, and privileged database access with no time or scope limits. The novelty isn’t the vulnerability. It’s that an AI agent, not a person, found the path through all of them and kept going without anyone needing to hold its hand.
Sysdig’s recommendations are unglamorous but concrete: patch known vulnerabilities like CVE-2025-3248 rather than assuming obscurity protects exposed AI infrastructure, rotate default signing keys and credentials on services like Nacos, never expose configuration services like Nacos directly to the internet, never connect such services to their backing database with root privileges, and deploy runtime detection capable of catching the kind of self-narrating, purpose-built payloads this attack produced. None of that is new advice. What’s new is how little time organizations now have to act on it once a gap is found.
Leave a Reply