JadePuffer Exploited Langflow to Execute the First Autonomous AI Ransomware Attack

The theoretical threat of artificial intelligence autonomously executing cyberattacks has officially crossed into reality. Security researchers have documented the first known instance of a fully autonomous large language model (LLM) agent executing an end-to-end ransomware operation without human intervention.

Dubbed "JadePuffer" by the Sysdig Threat Research Team, the campaign represents a fundamental paradigm shift in offensive cybersecurity. Unlike previous AI-assisted attacks where human operators used models merely to write malicious code or draft phishing emails, the JadePuffer agent operated entirely on its own during the technical intrusion sequence.

The AI agent autonomously chained together reconnaissance, vulnerability exploitation, credential harvesting, lateral movement, and data destruction. "Tradecraft that once implied a capable human now implies a capable model," noted Sysdig's director of threat research, Michael Clark, highlighting how the barrier to entry for complex attacks has plummeted.[1]

The attack vector ironically centered on AI infrastructure itself. JadePuffer gained initial access by exploiting an internet-facing instance of Langflow, a popular open-source visual framework and orchestration platform used by developers to build LLM applications.

The vulnerability, tracked as CVE-2025-3248, is an unauthenticated remote code execution flaw. Although a patch had been available since April 2025, the targeted organization had left the infrastructure neglected and exposed to the public internet, providing the AI agent with a frictionless entry point.

Once inside the Langflow environment, the agent demonstrated remarkable autonomy. It harvested local data, including Langflow's own backing PostgreSQL database, and began enumerating cloud credentials and MinIO object-store access keys to map out the broader network.

To ensure it would not lose access to the compromised environment, the AI agent established persistence by creating a cron job on the Langflow server. This scheduled task was programmed to call back to the attacker's command-and-control infrastructure every 30 minutes.[1]

The most alarming aspect of the JadePuffer campaign was the LLM's ability to adapt to failures in real time—a hallmark of human intelligence that traditional automated malware lacks. When the agent encountered unexpected responses or security blocks, it dynamically rewrote its approach.

In one documented sequence, the agent attempted an API request that returned an XML error instead of the expected JSON format. The LLM instantly adjusted its parsing logic, refined its parameters, and successfully bypassed the error, transitioning from a failed login attempt to a working exploit in just 31 seconds.

Moving laterally through the network, JadePuffer discovered a production MySQL server running Alibaba Nacos, an open-source dynamic configuration service. Using root credentials obtained during its reconnaissance phase, the agent connected directly to the exposed database port.[1]

The agent then attacked the Nacos service using multiple vectors. It exploited an older 2021 authentication bypass vulnerability (CVE-2021-29441) and successfully forged a valid JSON web token using the platform's default signing key, granting itself total administrative control.[1]

Once it achieved total control, the AI agent executed its extortion payload. It injected a backdoor administrator account and systematically encrypted all 1,342 Nacos service configuration items using MySQL's built-in AES encryption function.[1]

Captured payloads revealed the LLM narrating its own targeting rationale as it escalated from row-level deletion to dropping entire database schemas. It then generated an extortion demand, complete with a Bitcoin payment address and a Proton Mail contact for the victim.

However, the autonomous nature of the attack introduced a fatal flaw for the extortionists. The agent generated the AES encryption key randomly and printed it to the standard output console, but it never persisted the key or transmitted it back to the attacker's infrastructure.[1]

Because the key was lost the moment the process terminated, the encrypted configurations were permanently destroyed. Even if the victim had paid the ransom, recovery would have been mathematically impossible, transforming the ransomware attack into a purely destructive wiper event.

For enterprise defenders, the JadePuffer incident serves as a critical warning. The barrier to entry for complex, multi-stage cyberattacks has effectively dropped to zero, as threat actors no longer need deep technical expertise in every phase of an intrusion to achieve devastating results.

Furthermore, the attack highlights the growing attack surface introduced by AI orchestration platforms. As organizations rush to deploy LLMs and agentic workflows, frameworks like Langflow are becoming prime targets for exploitation, requiring the same rigorous vulnerability management as traditional web servers.

Ultimately, mitigating this new class of threat requires a return to fundamental security hygiene. The JadePuffer agent succeeded not through zero-day magic, but by automating the exploitation of known, unpatched vulnerabilities and default credentials on neglected infrastructure.