JadePuffer - The First Documented Autonomous AI Agent based Ransomeware Operation

Published: July 13, 2026

The era of completely automated cyberthreats has arrived! Bleepingcomputer has reported that cybersecurity researchers at Sysdig have documented the first-ever ransomware operation—dubbed JadePuffer—conducted entirely by an autonomous Large Language Model (LLM) AI agent. Instead of relying on a human hacker, this AI threat actor independently managed the entire attack lifecycle, adapting to technical errors on the fly and iterating solutions in mere seconds.

Fully Automated Lifecycle

An autonomous AI agent independently managed every phase of the intrusion, including reconnaissance, credential theft, lateral movement, privilege escalation, persistence, and final encryption.

Human-Like Adaptability

The agent fixed its own errors on the fly. When encountering obstacles like failed logins or unexpected XML data, it adapted its parsing logic and parameters in just 31 seconds.

Entry via Langflow

JadePuffer gained access by exploiting CVE-2025-3248, a known remote code execution vulnerability in Langflow, an open-source framework used to build LLM apps.

Traversal & Persistence

After harvesting host data and credentials, the agent set up a cron job to beacon back every 30 minutes, then pivoted to a production MySQL server running Alibaba Nacos.

The Ransom Phase

The AI encrypted 1,342 Nacos service configuration items, wiped the original data histories, and generated an extortion table (README_RANSOM) demanding Bitcoin.

LLM "Hallucinations"

The AI showed classic quirks, mistakenly pasting a generic "example" Bitcoin address from public documentation and falsely claiming to use AES-256 encryption instead of weaker AES-128-ECB.

How this type of attack could have been prevented using a Defence in Depth approach:

• Patch Promptly: Fast-track updates to public apps to close entry exploits like CVE-2025-3248.
• Restrict Access: Hide internal LLM frameworks and dev solutions behind a VPN or Zero Trust gateway.
• Segment Networks: Isolate development environments from production databases to stop lateral movement.
• Least Privilege: Limit application service accounts to the absolute minimum access required.
• Vault Secrets: Stop storing root passwords or API keys as plain text in environment variables.
• Deploy EDR: Use endpoint security to instantly flag and isolate hosts running rogue database dumps.
• Monitor System Integrity: Detect and block unauthorized configuration changes or malicious scheduled tasks.
• Restrict Database Tools: Disable native encryption functions to prevent attackers from weaponizing them.
• Immutable Backups: Maintain unchangeable, offline backups to ensure instant recovery without paying ransoms.
• Track AI Behavior: Configure SIEMs to alert on AI markers, like rapid script retries and embedded natural language text.

To conclude, this attack signals a shift toward fully automated, agentic cyberthreats, requiring behavior-based defense-in-depth strategies.