On July 1, Sysdig published something the security industry had been predicting and dreading in equal measure: a ransomware operation run entirely by a large language model. No human at the keyboard. No fixed exploit script. Just an AI agent chaining recon, credential theft, lateral movement, and extortion, all by itself, from one initial foothold. They named it JADEPUFFER, which sounds like a Pokémon and is somehow scarier for it.
I’ve spent years telling teams that ransomware is ultimately a human problem — behind every intrusion there’s an operator making decisions, getting tired, making mistakes. JADEPUFFER doesn’t remove the human from ransomware entirely. But it removes the human from the operation. And that distinction matters more than it first sounds, trust me.
The way in was depressingly familiar. An internet-exposed Langflow instance, vulnerable to CVE-2025-3248 — an unauthenticated remote code execution flaw, CVSS 9.8, patched in April 2025. CISA put it in the Known Exploited Vulnerabilities catalog a month later. More than a year after the patch, exposed instances were still sitting on the internet. And Langflow boxes are juicy targets, because they sit right next to AI workloads and usually hold cloud credentials and LLM provider API keys just… lying around in the environment. You know, as a treat.
From that foothold, the agent did what a competent human intruder would do, only faster and without pausing for coffee:
It mapped the host and harvested credentials. Cloud keys, LLM keys, database files, wallet phrases, configs. The works.
It pivoted into connected infrastructure through a chain of neglected weaknesses that reads like a museum tour: a 2021 Nacos auth bypass, a default JWT signing key that had been public since 2020, and default MinIO credentials (minioadmin:minioadmin, in case you were wondering whether defaults still get people pwned in 2026 — yes, yes they do).
And then my favorite detail. When its first backdoor insertion failed, the agent diagnosed the problem, deleted the broken account, and rebuilt it correctly. In 31 seconds. Without human intervention. Thirty-one seconds. I’ve seen human engineers take longer to find the right Slack channel.
Then it created the backdoor, encrypted 1,342 Alibaba Nacos configuration records, deleted the originals, and left a ransom note. Oh, and the ransom note’s payment address matched the example address from Bitcoin’s own documentation. Either the agent made up a plausible-looking wallet instead of using a real one, or a human configured it carelessly. Either way — and this is the part I love — it’s a very agent-shaped failure. Confident, and with no operator around to catch it before it reached its intended outcome.
flowchart TB
A[Internet-exposed Langflow] --> B[CVE-2025-3248\nunauthenticated RCE]
B --> C[AI agent foothold]
C --> D[Recon + credential harvest\ncloud keys, LLM keys, configs]
D --> E[Pivot via neglected flaws\nNacos bypass, default JWT key,\nMinIO default creds]
E --> F[Backdoor account\nself-repaired in 31s]
F --> G[Encrypt 1,342 Nacos records\nkey printed once, never stored]
G --> H[Delete originals + ransom note]
H ~~~ WM["TokensAnonymous.com"]
classDef wm fill:transparent,stroke:transparent,stroke-width:0,color:#9ca3af,font-size:9px
class WM wmHere’s the thing the Cloud Security Alliance got right: every individual step in this attack was old news. That’s the point. The operation is notable not for technical novelty but for the removal of a human from the decision loop at each stage. And that removal buys the attacker three things:
Speed. The 31-second self-repair is the headline, but the whole chain ran at machine pace. No operator to sleep, no shift change, no “we’ll pick this up tomorrow.”
Scale. One agent, one foothold, one complete extortion sequence. The marginal cost of the next victim is compute, not headcount.
Lowered skill floor. The operator doesn’t need to be good at intrusion anymore. They need to be good at pointing an agent at a target and letting it iterate. That’s a much bigger hiring pool, unfortunately.
But — and I want to be clear about this — the attack still started with a vulnerability patched over a year earlier, on an internet-facing system holding live credentials. The agent didn’t invent a zero-day. It walked through a door the industry left open and then moved fast once inside. So before we all panic about AI ransomware, maybe we should patch our stuff? Just a thought.
If you run AI infrastructure — Langflow, model servers, vector databases, orchestration UIs, all of it — three things, this week, no excuses:
Find your exposed AI tooling. If it’s on the internet and holds credentials, it is the target now. Not eventually. Now.
Treat agent-adjacent services as production infrastructure. Patch them on the same cadence as your edge, not on the “it’s just an internal tool” cadence. (Everything is “just an internal tool” until it’s in a Sysdig report.)
And assume the intruder iterates faster than your response. A 31-second self-repair means your detection has to fire on the first anomalous action, not on the completed chain. If your alerts only make sense in hindsight, they’re not alerts. They’re forensics. And forensics is just a fancy word for “we already lost.”
The humans-first version of this story is simple: the technology didn’t make ransomware smarter. It made it tireless. Our defenses still assume an adversary who gets tired. That assumption just expired. Bref.
Sources: Sysdig, Cloud Security Alliance, NSFOCUS.