Sysdig Documents JadePuffer, a Ransomware Attack Run End-to-End by an AI Agent

Sysdig says it identified JadePuffer as what it believes is the first documented ransomware operation conducted entirely by an autonomous LLM agent. Rather than a human operator running tools by hand, the researchers describe an AI agent performing each stage of the intrusion: reconnaissance, credential theft, lateral movement, persistence, privilege escalation and encryption.

A defining characteristic, according to Sysdig, was the agent's ability to adapt to failures in real time. The company says the operation retried failed steps within refined parameters rather than performing simple repeated attempts.

According to Sysdig, JadePuffer gained initial access by exploiting CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow, a popular open-source framework for building LLM apps. The vendor fixed the flaw on April 1, 2025, and in early May 2025 CISA flagged it as exploited in attacks targeting internet-exposed endpoints — deployments often lightly hardened but holding cloud credentials and API keys.

After obtaining code execution, Sysdig says the agent dumped Langflow's PostgreSQL database, collected host information, searched for environment variables and sensitive files, retrieved credentials and enumerated a MinIO object store. The researchers highlight the adaptive behavior during MinIO enumeration: when one API request returned XML instead of JSON, the next payload adjusted its parsing logic accordingly.

For persistence, the agent installed a cron job on the Langflow host configured to beacon to attacker infrastructure every 30 minutes. From there, Sysdig says the attacker pivoted to a production MySQL server running Alibaba Nacos using root credentials whose origin the company could not determine.

Nacos was targeted with multiple payloads, including one exploiting CVE-2021-29441, an authentication bypass that creates rogue administrator accounts. The agent then probed for container escape methods and deployed the ransomware payload.

Sysdig says the agent encrypted all 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT(), dropped the original config_info and history tables, and created an extortion table named README_RANSOM containing the demand, a Bitcoin payment address and a Proton Mail contact.

Sysdig cites several indicators that an AI agent controlled the operation. The generated code contained detailed natural-language comments describing operational reasoning, and the attack iterated rapidly in ways that accounted for the specific errors encountered rather than blindly retrying.

The ransom note claims the data was encrypted with AES-256, but Sysdig believes this is an overstatement and that weaker AES-128-ECB was more likely used. The researchers also note the encryption key was randomly generated but not stored or transmitted to the attacker — meaning recovery via the operator may not be possible.

Another tell: the Bitcoin address in the ransom note is an example address widely used in public documentation, which Sysdig suggests may be the LLM reproducing it from training data rather than a functional payment channel.

Sysdig concludes that JadePuffer demonstrates the arrival of "agentic threat actors" (ATAs), lowering the skill required to conduct damaging cyberattacks. If an autonomous agent can run a full kill chain against exposed infrastructure, the pool of potential attackers widens considerably.

At the same time, the company notes that the way AI agents operate today — verbose reasoning, distinctive code patterns and rapid iteration — creates new detection opportunities for security solutions.

The most direct mitigations target the exploited entry points and exposure:

• Patch Langflow against CVE-2025-3248 (fixed by the vendor on April 1, 2025).
• Patch or restrict Alibaba Nacos to address CVE-2021-29441.
• Remove Langflow, Nacos and similar management interfaces from direct internet exposure.
• Rotate cloud credentials and API keys stored on exposed hosts and enforce least privilege.
• Audit for unexpected cron jobs, rogue admin accounts and outbound beaconing.