JADEPUFFER: The First Documented Ransomware Attack Run End-to-End by an AI Agent

Cloud security firm Sysdig documented what it assesses to be the first fully agentic ransomware attack against production infrastructure. The operator, dubbed JADEPUFFER, used an LLM agent to independently plan, adapt, and execute an intrusion that ended with a company’s production database encrypted and wiped.

The entry point was CVE-2025-3248, a missing-authentication flaw in Langflow, the open-source tool for building AI apps and agent workflows. The bug lives in the /api/v1/validate/code endpoint, which passes unauthenticated user input straight into Python’s exec() — no sandboxing, no auth check. CVSS 9.8. It affects every Langflow version before 1.3.0, which shipped the fix back in March 2025, and it’s already on CISA’s Known Exploited Vulnerabilities list after being used to deploy the Flodrix botnet. If you’re running Langflow anywhere internet-facing, check your version now: pip show langflow or the equivalent in your deployment, and upgrade to 1.3.0+ if you’re behind.

What makes JADEPUFFER notable isn’t the vulnerability — it’s what happened after the initial foothold. The LLM agent handled reconnaissance, credential theft, and lateral movement itself, adapting to failures the way a human operator would. In one documented sequence, the agent hit a failed login, diagnosed the cause, and produced a working fix in 31 seconds. It then pivoted deeper into the network until it reached the target’s production database server, where it ran the encryption and wipe.

Sysdig is careful about the scope of the claim: a human was still required to set up and point the operation, provisioning the command-and-control server and the staging infrastructure beforehand. This wasn’t a fully autonomous attack from initial access to ransom note — it was a human-directed operation where the exploitation-through-impact chain ran without further human input. TechCrunch’s framing captures the nuance well: “the first AI-run ransomware attack still needed a human.”

That distinction matters for defenders. Traditional ransomware relies on either human operators manually chaining steps or rigid, pre-scripted toolkits that fail when the environment doesn’t match expectations. JADEPUFFER demonstrates that off-the-shelf LLM agents can absorb that adaptive-improvisation role today, using nothing more exotic than a known CVE and a public agent framework. The barrier to “agentic” attacks isn’t novel AI capability anymore — it’s just someone deciding to point an agent at the exploit chain instead of running it by hand.

If you operate any Langflow instance, patch immediately and audit for the Flodrix indicators of compromise Trend Micro has published. More broadly: assume adversaries now have access to the same adaptive, tool-using agents your engineering team does, and that your incident response timelines need to shrink accordingly — 31 seconds to route around a blocked login doesn’t leave much room for a human analyst to catch it live.

Sources

Related reading