JadePuffer: The World's First Fully Autonomous AI Ransomware Attack Signals a New Era in Cyber Threats

Researchers at cloud security firm Sysdig have published findings on what they assess to be the first fully documented case of agentic ransomware: a real-world cyberattack executed end-to-end by a large language model, without a human operator conducting any of the technical steps. The operation, which Sysdig's Threat Research Team has dubbed JadePuffer, gained initial access to an internet-facing Langflow server by exploiting CVE-2025-3248, a critical unauthenticated remote code execution vulnerability in the popular open-source framework used to build LLM applications. From there, the AI agent pivoted to a production database server and ran what Sysdig described as a fully adaptive, automated ransomware campaign, ultimately encrypting 1,342 Nacos service configuration items and demanding a ransom — all without human intervention.

What distinguishes JadePuffer from earlier automated malware is the quality of its autonomous reasoning. According to Sysdig, the agent executed more than 600 distinct, coordinated payloads during the intrusion, and its code was self-narrating — saturated with natural-language commentary explaining the rationale for each action, including the prioritisation of high-value targets and identification of the largest available database. As Michael Clark, director of threat research at Sysdig, wrote in the firm's detailed research paper, the LLM's behaviour under failure conditions was particularly striking: when an attempt to create a backdoor administrator account in Alibaba's Nacos platform failed, the agent diagnosed the error and generated a working fix within 31 seconds. Dark Reading noted that this adaptive speed — compressing what might take an experienced human operator hours into a matter of minutes — fundamentally alters the calculus for defenders across every phase of incident response.

The attack's technical architecture exploited vulnerabilities that were, individually, not new. Sysdig noted that JadePuffer also leveraged CVE-2021-29441, a years-old Nacos authentication bypass, alongside default credentials that had never been rotated. What the AI agent contributed was the ability to chain those legacy weaknesses together into a coherent, adaptive kill chain — reconnaissance, credential theft, lateral movement, privilege escalation, and destructive encryption — without the operator needing expertise in any individual step. Cybernews reported that Sysdig's Threat Research Team described the attack as capable of bringing the cost of running a ransomware campaign close to zero if the agent operates on stolen credentials through a technique known as LLMjacking, in which attackers abuse compromised AI API keys to run frontier models without paying for them.

The precise model powering JadePuffer remains unidentified. In a subsequent interview with CyberScoop, Clark clarified that Sysdig was unable to determine the specific LLM driving the agent, and had no visibility into its system prompt or configuration, as TechCrunch reported. Microsoft researcher Geoff McDonald, writing on LinkedIn, theorised that an open-weight model with safety training stripped out was the more likely culprit than a frontier lab model, citing his own red-teaming experience showing that safety layers at major providers hold up relatively well. The distinction matters for policy: if the capability is already replicable with freely available open-weight models, export controls on frontier model providers provide limited protection against the proliferation of agentic attack tooling.

For enterprise security teams, the JadePuffer disclosure demands immediate action on several fronts. Sysdig urged all organisations running Langflow to patch immediately to version 1.3.0 or later and to implement runtime threat detection. More broadly, as independent researcher Vibhum Dubey told CSO Online, defenders should expect future intrusions to move faster and require less hands-on interaction from attackers, shifting the most dangerous phase of an attack to the quiet pre-encryption period in which an agent maps identities, privileges, and trust relationships while evading detection. Singapore's Cyber Security Agency, in its recently published national cyber landscape report, had already warned that agentic AI is capable of automating parts of the cyber kill chain and accelerating exploit development at a speed that outpaces existing defence architectures. JadePuffer's emergence suggests that warning was not theoretical. As agentic tooling matures and becomes more packaged and reusable, security experts warn, the barrier to entry for sophisticated ransomware campaigns will continue to collapse.