Security researchers have identified JadePuffer as the first ransomware operation conducted entirely by an AI agent, marking a watershed moment in automated cyberattacks. Discovered by cloud security firm Sysdig, this incident demonstrates how large language model (LLM) agents can now execute complex intrusion campaigns without human intervention during the attack itself.
Attack methodology
The attack began by exploiting CVE-2025-3248, a critical remote code execution vulnerability in Langflow, an open-source platform for building LLM applications. Once inside the initial server, the AI agent systematically gathered intelligence, harvested credentials, and mapped the network to identify higher-value targets. It then pivoted to a production server running MySQL and Nacos configuration management, where it leveraged another known authentication bypass vulnerability to gain administrative access.
What made JadePuffer particularly notable was its ability to detect and correct errors autonomously during the attack. When the agent's first attempt to create an administrator account failed, it analyzed the error and launched a corrected procedure just 31 seconds later, successfully modifying its credential generation approach. Sysdig researchers emphasized that this rapid self-correction capability is a strong indicator of genuine agentic behavior rather than a human operator using conventional automation tools.
After securing access, JadePuffer encrypted more than 1,300 configuration elements in the database, deleted the original tables, and left a ransom note with a Bitcoin address and contact email. However, analysis revealed a disturbing detail: the encryption key was never stored or transmitted to any attacker-controlled server, suggesting victims could not recover their data even if they paid. Researchers believe this indicates the attack was oriented more toward data destruction than financial extortion, with claims of external backups appearing to be psychological pressure tactics without evidence of actual exfiltration.
Security implications
While JadePuffer has drawn attention to AI's role in cybercrime, experts stress that the fundamental vulnerability was poor security hygiene rather than the AI itself. Exposed credentials, unpatched vulnerabilities, default configurations, and excessive privileges enabled the agent to traverse the infrastructure within minutes. This incident underscores the urgent need for organizations to harden their AI application deployments, implement zero-trust architectures, and maintain rigorous patch management, as autonomous agents will increasingly exploit any weakness they encounter at machine speed.