For as long as ransomware has existed, there's been a human somewhere in the loop either at the keyboard live, or having written the script the malware follows. That assumption just broke. Cybersecurity firm Sysdig says it has captured the first documented case of "agentic ransomware": a complete extortion operation, from initial break-in to database destruction, driven entirely by a large language model with no human operator steering it in real time.
How JadePuffer got in
Sysdig's Threat Research Team dubbed the campaign JADEPUFFER. The AI agent gained its foothold by exploiting CVE-2025-3248, a missing-authentication flaw in Langflow, a popular open-source framework developers use to build LLM-powered apps. The bug lets anyone who can reach the server run their own code on it, no login required. It had already been patched back in 2025 and flagged by CISA as actively exploited but the victim's instance was never updated, and Langflow servers are a favorite target precisely because they're AI-adjacent: they tend to hold cloud credentials and provider API keys, and get spun up quickly without much network hardening.
An agent that adapted like a person
What makes JadePuffer notable isn't the individual techniques none of them were new. It's that an AI model chained reconnaissance, credential theft, lateral movement, persistence, and destruction together on its own, correcting itself along the way. Once inside, the agent mapped the host, swept for API keys and cloud credentials, and found a MinIO storage server still using its factory default login. It planted a scheduled task to phone home to attacker infrastructure every 30 minutes, then pivoted to its real target: a production server running MySQL and Alibaba's Nacos configuration service.
When an early login attempt to create a backdoor admin account failed, the agent diagnosed the error and had a working fix ready in 31 seconds the kind of real-time troubleshooting researchers say points clearly to an autonomous system rather than a fixed script. Sysdig also noted the payloads were "self-narrating," containing natural-language reasoning about targets and next steps that reads like an AI thinking out loud, not a human-written exploit.
The damage and why paying won't help
In its final phase, the agent encrypted all 1,342 Nacos configuration items using MySQL's built-in encryption function, deleted the original tables, and dropped a ransom note demanding Bitcoin, along with a Proton Mail contact. But there's a twist: the encryption key was generated randomly and printed once to the terminal never stored, never sent anywhere. That means even a victim willing to pay has no way to actually recover the data. Researchers believe the operation was aimed more at destruction than at collecting a payout.
Why this matters beyond one attack
Security researchers frame JadePuffer as an evolution, not a revolution every technique it used was already familiar. What's changed is the cost of running an attack. As Sysdig's Michael Clark put it, the skill floor for ransomware has dropped to whatever it costs to rent an agent, and if that agent is running on stolen API credits, the cost to the attacker approaches zero. That has real implications for anyone running exposed infrastructure: AI tooling like Langflow needs to be treated as critical, tightly controlled software, not a lab toy patched promptly, kept off the open internet, and never holding live credentials in its environment.
JadePuffer follows a string of AI-driven security incidents through 2025 and into this year, including a Claude Code–powered extortion campaign and a largely autonomous, state-linked spying operation disclosed by Anthropic. The pattern researchers keep pointing to is the same: the tools attackers use are getting faster and requiring less hands-on human effort, and defenders should plan for intrusions that move at machine speed.
Cyber Security Ransomware Email Phishing Encrypted Technology, Digital Information Protected