An AI Agent Just Ran a Ransomware Attack, Start to Finish
A threat actor has used an LLM agent to execute a full ransomware campaign against real infrastructure, and the attack worked. Cloud security firm Sysdig tracked the operation, attributing it to a group they call JadePuffer.
The entry point was CVE-2025-3248, a critical unauthenticated remote code execution flaw in Langflow, the open source Python framework used to build LLM-driven agent workflows. The vulnerability carries a CVSS score of 9.8, was publicly disclosed in April, and CISA confirmed active exploitation by early May. If you had a Langflow instance hanging off the public internet unpatched, this is what happened next.
Once inside, JadePuffer did not sit around manually typing commands. The LLM agent went straight to work on reconnaissance, sweeping the host for API keys, cloud credentials, crypto wallets, database passwords, and configuration files. It dumped Langflow's Postgres database, scanned the internal network for reachable services, probed MinIO endpoints for more credentials, and dropped a cron job for persistence. Sysdig observed the model adapting in real time, adjusting how it extracted credentials depending on the file type encountered and logging into discovered endpoints as it went.
Phase two involved pivoting to a production server running MySQL alongside Alibaba's Nacos configuration platform. Nacos has a well-documented history of security bypasses, and critically, it ships with a well-known default JWT signing key, meaning token forgery is trivially easy for anyone who has done thirty seconds of research.
JadePuffer hit Nacos from multiple angles simultaneously. The agent exploited the auth-bypass vulnerability CVE-2021-29441, forged a valid JWT using the default signing key, and injected a backdoor administrator account directly into the Nacos backing database using the root MySQL credentials it already held. The LLM adjusted its login payload on the fly to pass verification, checked for User Defined Functions that could enable OS command execution, and then moved to the ransomware phase.
It encrypted 1,342 Nacos service configuration items and created an extortion table with a ransom demand, a payment address, and a contact email. The encryption key was randomly generated and never stored or transmitted anywhere. Recovery without paying is effectively impossible.
Sysdig noted something particularly uncomfortable in the captured payloads: the LLM narrated its own actions in natural language, escalating from row-level deletions to dropping entire database schemas while explaining its reasoning as it went. This was not pattern-matched scanning. The agent was reading free-text context from the target environment and making decisions based on what it understood. That behaviour was consistent across sessions weeks apart.
The broader implication here is not subtle. Running a sophisticated, multi-stage attack against neglected infrastructure now requires a capable model, not a capable human. The cost to the attacker is close to zero. The LLM handled the reconnaissance, lateral movement, credential abuse, and encryption autonomously, combining known techniques in a way that previously would have demanded real expertise.
Sysdig's assessment is blunt: expect more of this as agentic tooling matures. Exposed application servers, unhardened configuration stores, and internet-facing database admin accounts are the obvious first targets. If your Langflow instance was public-facing and unpatched two months ago, the question is not whether it was a risk. It is whether anyone noticed.