JadePuffer: The First Ransomware Attack Run Entirely by an AI Agent

A ransomware operation ran from first foothold to ransom note without a human operator making the tactical calls. Sysdig’s threat research team, who caught and documented the intrusion, is calling it JadePuffer, and their read is that it is the first ransomware attack where an LLM agent handled reconnaissance, credential theft, lateral movement, privilege escalation, and database encryption as one continuous, adaptive operation.

The entry point was ordinary. What happened after is not.

How it got in

JadePuffer’s initial access came through CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, the open-source framework teams use to visually assemble LLM and RAG pipelines. It’s a known flaw with a known fix. If your team has been prototyping agent workflows on an unpatched Langflow instance, this is the second reason this month to check your version, after CVE-2026-55255 put a different Langflow bug on CISA’s Known Exploited Vulnerabilities list just last week.

That repetition is itself a data point. Langflow isn’t unusually broken, it’s unusually exposed: it’s the kind of tool teams stand up quickly to experiment with agents, rarely put behind the same access controls as production systems, and then forget is holding API keys and database credentials.

What happened after the exploit is the actual news

Getting in through a known RCE isn’t novel. What Sysdig documented next is. Once inside, the intrusion ran through a full attack chain, more than 600 coordinated payloads executed in sequence, covering reconnaissance, credential theft, lateral movement across the network, persistence and privilege escalation, and finally encryption of the target database before dropping a ransom note.

Human-operated ransomware intrusions typically stretch over days, sometimes weeks, as an operator works through a target’s defenses, often handing off between reconnaissance specialists and encryption specialists on the same criminal team. JadePuffer compressed that into a single continuous run, and did it by adapting to obstacles rather than following a pre-written script. When a step failed, the operation adjusted and tried a different approach, the behavior of something reasoning about the environment in front of it rather than executing a fixed playbook.

How researchers know it was an agent, not just automation

Attribution here doesn’t rest on a hunch. The payloads themselves carry the signature. Sysdig found self-narrating, natural-language comments embedded in the dropped code: reasoning about which targets to prioritize, explanations of why a particular lateral-movement path was chosen, the kind of verbose in-line commentary that LLMs generate reflexively as part of producing code, not something a human attacker bothers to write into malware meant to stay hidden.

That’s the tell that separates JadePuffer from “AI-assisted” attacks, where a human uses a chatbot to help write a phishing email or debug an exploit. Here, the reasoning trace of an agent working through a live intrusion got left behind in the artifacts, because the agent wasn’t being careful about hiding its own thought process, it was just trying to accomplish the objective.

Why this matters beyond one incident

For the past two years, most of the security conversation around LLMs has centered on prompt injection and model behavior: can you trick a chatbot into saying something it shouldn’t. JadePuffer is a different kind of warning. It shows that the same reasoning-and-adaptation capability that makes coding agents useful for legitimate development work is directly reusable for offensive operations, and that reuse doesn’t require a novel jailbreak or a frontier model with unusual capabilities. It requires an agent, a known vulnerability, and enough autonomy to keep going when the first approach fails.

That has a direct parallel to a problem we covered earlier this week: coding agents that get tricked into executing malicious code they were supposed to be reviewing. Both stories point at the same underlying shift. Once you give an AI agent the ability to act, not just suggest, its mistakes and its misuse both move at agent speed, not human speed.

What to actually do about it

Nothing here calls for exotic new tooling. The fundamentals just got more urgent:

• Patch known CVEs in LLM tooling (Langflow, vector databases, agent orchestration frameworks) with the same priority you’d give an internet-facing production service, not the lighter treatment an “internal prototyping tool” usually gets.
• Treat any system holding LLM provider keys or cloud credentials as a high-value target regardless of how it’s labeled internally, because that’s exactly what attackers are going after first.
• Assume that once a foothold exists, the follow-on chain can move in hours, not days. Detection and response timelines built around human-operator pacing need to shrink.
• Audit what agent frameworks you’ve deployed and who can reach them. A tool that’s easy to stand up is also easy to forget about.

JadePuffer is one documented case, and the entry vector was an ordinary, patchable bug rather than something new. The part worth taking seriously is what happened after the door opened: the technical capability for a fully autonomous, adaptive intrusion already exists, and it’s now been used outside a research paper.