AI Agent Runs Ransomware Attack Start to Finish, No Human Required
Sysdig's threat research team has documented what they're calling the first fully agentic ransomware attack, where an LLM handled the entire operation autonomously. No human operator directing steps from a keyboard. Just an AI, a vulnerable server, and a fairly grim outcome for the victim.
The team named the threat actor JadePuffer. It got in through CVE-2025-3248, a missing authentication bug in Langflow that lets unauthenticated remote attackers execute arbitrary Python on the host. From there, the agent ran the whole playbook itself.
What caught Sysdig's attention wasn't just the automation. It was the behaviour. According to threat research director Michael Clark, JadePuffer's payloads were self-narrating, complete with natural language reasoning and annotations explaining what it was doing and why. Human attackers rarely bother documenting their own intrusions in real time. LLMs, apparently, can't help themselves.
The agent also recovered from failures fast. In one recorded sequence it went from a failed login attempt to a working fix in 31 seconds, adjusting parameters and retrying without any external prompt.
Once inside via the Langflow exploit, JadePuffer started hoovering up credentials. API keys for LLM providers, cloud credentials covering AWS, Azure, GCP, and several Chinese providers including Alibaba, Aliyun, Tencent, and Huawei, cryptocurrency wallets, and database credentials. It also planted a crontab entry to phone home every 30 minutes, keeping a foothold on the compromised server.
The real target was a separate production server running MySQL and Alibaba's Nacos configuration platform. Nacos is an open-source service discovery and dynamic configuration tool common in microservices setups. It was exposed to the internet, which is precisely the sort of thing you should never do.
JadePuffer connected to MySQL using root credentials. Sysdig doesn't know where those came from, but they weren't lifted from the victim's environment during the attack. The agent then hit Nacos from multiple angles: exploiting an authorisation bypass (CVE-2021-29441), forging a valid JWT using Nacos's default signing key, and using its root database access to inject a backdoor admin account directly into the Nacos backing database.
From there it encrypted all 1,342 Nacos service configuration items using MySQL's built-in AES encryption. Then came the ransom note, a Bitcoin address, and a Proton Mail contact.
There's a particularly ugly twist here. The agent didn't just encrypt the data, it dropped entire database schemas while narrating its own targeting rationale. No backup was taken before encryption. So even if someone paid the ransom, there's nothing to recover. The data is gone.
If you're running Langflow, patch it now and stop exposing code-execution endpoints to the internet. If you're running Nacos, it should not be publicly accessible under any circumstances. Change the default token signing key and upgrade to a version that forces you to set a custom one.
More broadly, Sysdig recommends not running AI orchestration servers in environments where provider API keys or cloud credentials are present. Which, given what JadePuffer did with exactly that setup, seems like reasonable advice.