JADEPUFFER: first AI agent runs ransomware attack solo

Key Takeaways

• JADEPUFFER is the first documented ransomware operation run entirely by an AI agent without human control
• The agent self-corrected a failed login attempt and built a working admin account in 31 seconds
• The attack exploited a year-old Langflow vulnerability that had been patched but never applied

Security firm Sysdig has documented what it calls the first agentic ransomware operation. An AI agent named JADEPUFFER broke into a server, stole credentials, and encrypted a production database, all without a human at the controls. The attack exploited a year-old vulnerability in Langflow, a popular tool for building AI applications, that had been patched but never applied by the victim.

How did the AI agent break in?

JADEPUFFER entered through CVE-2025-3248, a flaw in Langflow that lets attackers run arbitrary code on a server without authentication. Langflow patched the vulnerability in April 2025. The US Cybersecurity and Infrastructure Security Agency added it to its catalog of actively exploited vulnerabilities shortly after, an official warning to update immediately. The victim never applied the patch.

From that initial foothold, the agent worked forward autonomously. It collected credentials, established persistent access, and eventually reached a separate production server running MySQL. That database was the real target.

What proves no human was typing?

Sysdig's researchers point to one moment as the strongest evidence. The agent tried to create an admin account. The login failed. Thirty-one seconds later, it sent a corrected command that diagnosed the error, deleted the broken account, and built a working replacement. A human reading the error message, understanding the cause, and writing new code would take much longer.

Another tell: the AI-generated code included natural-language comments explaining why it wanted to delete a particular database first. Human attackers almost never annotate their scripts that way. AI models do it reflexively, pulling from training data patterns where documentation is standard.

The agent encrypted 1,342 configuration entries and deleted the original tables. A ransom note demanded Bitcoin and listed a Proton Mail address. But the decryption key was displayed once, never saved, and never transmitted anywhere. Paying the ransom would not have recovered the data. The Bitcoin address turned out to be a well-known example address from developer documentation, likely copied straight from training data.

Why does this matter for product teams?

None of the individual techniques were new. The attack chained together long-known vulnerabilities and weak default passwords. What changed is that an AI model assembled them into a complete extortion operation on its own. That drops the barrier for ransomware to the cost of running an AI agent. No malware development skills required. No manual reconnaissance. No operator fatigue.

Shane Barney, chief information security officer at Keeper Security, told Hackread that JADEPUFFER should be read less as science fiction and more as a credential management failure at machine speed. The deciding factor was not novel attack techniques. It was exposed secrets, unchanged default passwords, wide-open privileged access, and no real-time monitoring.

“JADEPUFFER should be read less as science fiction and more as a credential management failure at machine speed.”

— Shane Barney, CISO at Keeper Security

Barney cited a Keeper study finding that 72 percent of organizations cannot detect credential misuse in real time. Many do not notice unauthorized privileged access until hours after it begins. That gap becomes dangerous when an AI agent can go from a failed login to a working admin account in under a minute.

What defenses actually work?

Barney's recommendations are direct. Privileged access needs to be time-limited and scoped to individual tasks. Secrets belong in protected vaults with regular rotation. Sessions need monitoring while they are active, not after the damage is done.

For teams building AI applications, the Langflow vulnerability underscores a familiar problem. Tools in the AI stack move fast. Patches ship. But production systems running those tools often lag behind. A patch available for over a year was never applied. That single oversight gave JADEPUFFER its opening.

Automated vulnerability scanning and patch management become more urgent when adversaries can exploit at machine speed. Tools like n8n or Zapier can automate alerting workflows when critical CVEs hit your stack, though they are no substitute for disciplined patching cycles.

Are other security firms confirming this?

No independent confirmation from the victim, law enforcement, or other security firms exists so far. Sysdig sells products designed to detect exactly these kinds of automated attacks, which warrants noting. The company's threat research team has a track record of credible disclosures, but the single-source nature of this report means the full picture may evolve.

Frequently Asked Questions

What is agentic ransomware?

Agentic ransomware refers to ransomware operations run autonomously by an AI agent rather than a human operator. The agent independently identifies vulnerabilities, breaches systems, steals credentials, and deploys ransomware without human intervention.

How fast did JADEPUFFER correct its own mistakes?

JADEPUFFER self-corrected a failed admin account creation attempt in 31 seconds, diagnosing the error and building a working replacement without human guidance.

What vulnerability did JADEPUFFER exploit?

JADEPUFFER exploited CVE-2025-3248 in Langflow, a flaw that allows attackers to run code on a server without authentication. The patch had been available for over a year.

Would paying the ransom have recovered the data?

No. The decryption key was displayed once and never saved or transmitted. The Bitcoin address was a documentation example, not a real wallet.

How can organizations defend against agentic attacks?

Time-limit privileged access, store secrets in vaults with regular rotation, monitor sessions in real time, and apply patches promptly. Speed of response now needs to match speed of attack.

Source: The Decoder / Maximilian Schreiner