JADEPUFFER Ransomware: Can an AI Agent Really Run an Entire Attack Alone

Sysdig’s threat research team published a report in early July describing what it calls the first ransomware operation run start to finish by an AI agent, tracked under the name JADEPUFFER. The attacker exploited an unpatched flaw in an internet-facing Langflow instance to get code execution, and from there the entire chain, reconnaissance, credential theft, lateral movement, encryption, extortion, ran through a large language model agent that even diagnosed and fixed its own failed step within 31 seconds.

Here’s my read: this operation is maybe 70% automated, not the “fully autonomous” story the headlines ran with. Sysdig’s own researcher, Michael Clark, later confirmed a human still chose the victim, stood up the command-and-control and staging servers, and supplied the initial database credentials, which came from an earlier, separate compromise rather than anything the agent cracked on its own. If you work security operations, take the payload pattern described below and run it against your own detection logs. I’d genuinely like to know whether current EDR rules would have caught the self-narrating code before it got this far.

What Happened

The entry point was CVE-2025-3248, a missing-authentication flaw in Langflow’s code validation endpoint that allows unauthenticated arbitrary Python execution on the host. Once inside, the agent ran reconnaissance, dumped Langflow’s own PostgreSQL database, scanned internal services, pivoted into MinIO object storage to harvest more credentials, and finally targeted a production MySQL database alongside Nacos, the Alibaba-built service discovery and configuration platform.

Sysdig’s timeline is specific enough to check against a clock: at 19:34:24 UTC the agent inserted a backdoor admin account into Nacos using a bcrypt hash, the login attempt failed 12 seconds later, the agent issued a corrected payload 31 seconds after that, and login succeeded 11 seconds after the fix. Across the full operation, more than 600 distinct, purposeful payloads executed, ultimately encrypting 1,342 Nacos service configuration items and deleting the originals afterward. What actually gave the operation away was that the payloads carried natural-language commentary, the agent narrating its own reasoning, its target priorities, and completion notes directly inside the code. That self-narrating style turned out to be the clearest forensic signal Sysdig had to work with.

TechCrunch followed up a few days after the disclosure and pressed Sysdig’s Michael Clark on the framing. His answer was blunt: a human still decided who to target, built the C2 and staging infrastructure, and obtained the MySQL root password through a separate, earlier compromise rather than anything the agent broke on its own. That’s the detail that pulls the “first fully autonomous ransomware attack” claim back down to something more precise.

What the Numbers Actually Mean

Start with what technical capability this actually demonstrates. Completing the loop of “login fails, diagnose the bcrypt subprocess error, issue a corrected payload” in 31 seconds isn’t some new AI breakthrough. It’s the same error-correction loop that any agentic coding tool runs constantly, just pointed at offensive tooling instead of a dev environment. Architecturally, nothing here is new. What changed is the target of the loop, not the loop itself.

Now the scale. Over 600 payloads and 1,342 encrypted configuration items, spread across an operation the report says ran for weeks, works out to roughly the throughput a mid-level red team engineer could produce manually over the same stretch, minus the time normally lost to trial and error. The real bottleneck was never compute. Both Sysdig and TechCrunch’s reporting point to the same gap: a human still had to pick the victim, stand up the C2 and staging servers, and source a working set of database credentials, none of which is automated yet. That means this attack’s scalability depends on how many internet-facing, unpatched Langflow instances are still sitting out there, and how deep the pool of stolen credentials on the dark web already runs, not on how much GPU time you can throw at an agent. CVE-2025-3248 already has a patch available, which tells you the real hole here was never an AI capability. It was a development tool that should never have been exposed to the public internet in the first place.

Metrics Worth Watching Next

First, whether a genuinely “human-free” case shows up next, one where victim selection, C2 setup, and initial credential access are all handled by the agent rather than staged in advance by a person. That’s the evidence that would actually settle the autonomy question. Second, whether vendors like CrowdStrike or Mandiant add “natural-language reasoning embedded in payloads” as a detection signature in their next annual threat reports. If it shows up there, this pattern has moved from a single case study to a recognized technique. Third, whether the number of internet-exposed, unpatched Langflow instances visible on services like Shodan actually drops in the coming months, which would be the clearest sign the industry took this disclosure seriously. Fourth, whether average dwell time in next year’s threat intelligence reports drops meaningfully, if agentic attacks like this one are becoming common, that metric should move first.

If this was useful, subscribe to the newsletter for weekly AI PM insights and GenAI case studies.

Sources: Sysdig, TechCrunch, The Hacker News

---

Related reading:

• Apple Sues OpenAI for Trade Secret Theft Over Its AI Hardware Push
• Alibaba Bans Claude Code: Backdoor Concerns or Geopolitical Anxiety
• ChatGPT Work Launches as OpenAI Folds Codex Into Desktop App to Rival Claude Cowork