Sysdig’s Threat Research Team has documented JADEPUFFER, assessed to be the first ransomware operation whose technical execution was driven end to end by an AI agent. A large language model handled the intrusion itself: it broke into an internet-facing Langflow server through CVE-2025-3248, swept the host for credentials, pivoted to a production database, and encrypted 1,342 Nacos configuration items before deleting the originals. Sysdig has since clarified that a human handler chose the victim, provisioned the infrastructure, and supplied stolen root database credentials. Because the encryption key was never saved, the data is unrecoverable even if the victim pays.
Update, July 16, 2026: this article has been revised. Our original version said no human was at the keyboard. Sysdig’s Michael Clark has since told CyberScoop and TechCrunch that a human operator set up the command-and-control and staging servers, selected the victim, and supplied database credentials obtained through a prior compromise. The technical execution remained the agent’s. Details in the section on autonomy below.
Sysdig calls the operator an “agentic threat actor” (ATA): an attacker whose capability is delivered by an AI agent rather than a human running a toolkit. It is the clearest evidence yet that the skill floor for ransomware has dropped to near zero. The agent chained reconnaissance, credential theft, lateral movement, persistence, and destruction without any single step requiring an expert behind it. The human contribution was targeting and logistics, not tradecraft. This piece breaks down what happened, how Sysdig knew a machine was driving, and what defenders should take from it.
What is JADEPUFFER?
JADEPUFFER is the name Sysdig gave to a captured attack in which every technical stage of a database-extortion campaign was executed by an LLM-driven agent. It is not a piece of ransomware in the traditional sense of a fixed binary. It is an autonomous operation: the model reasoned about the environment in real time, wrote its own payloads, adapted when steps failed, and produced its own ransom note. This is the difference between a script and an agent. A script does what it was told; JADEPUFFER decided what to do next as it went.
The distinction matters because it changes who can run an attack like this. For years, the ransomware economy has run on division of labour: initial access brokers sell the foothold, affiliates handle lateral movement, and operators run negotiation. An agent that can do all three collapses that supply chain into a single prompt.
How did the attack unfold?
The agent gained initial access through an exposed Langflow instance vulnerable to CVE-2025-3248, then ran a fully automated campaign that pivoted to the intended target. From the Langflow host, it listed system details, searched for API keys and cloud credentials, dumped Langflow’s PostgreSQL data, checked reachable internal services, and probed MinIO object storage using default credentials. It then moved to a production MySQL server running Alibaba’s Nacos configuration service, using root credentials that Sysdig later said were obtained through a prior compromise and handed to the operation by its human handler, and attacked Nacos with multiple payloads including one exploiting CVE-2021-29441, an authentication bypass that creates rogue administrator accounts.
How did Sysdig know an AI was driving?
The payloads gave it away. JADEPUFFER’s own code was self-narrating, full of natural-language reasoning, target prioritisation, and the kind of verbose annotations that human operators rarely write but LLM-generated code produces reflexively. The operation adapted in real time, retrying failed steps within refined parameters. In one sequence it went from a failed login to a working fix in 31 seconds, a turnaround that reads as machine speed rather than a human reading logs and re-typing.
This matches the pattern Ransomnews has tracked in the broader agentic AI threat space, where autonomous tool-use turns a language model into an operator. The tell is not any single clever move. It is the combination of relentless iteration, verbose self-explanation, and inhuman timing across every phase of the attack.
How autonomous was it really?
Less than the first wave of headlines suggested, including ours. In a follow-up interview with CyberScoop, Sysdig’s senior director of threat research Michael Clark said a human “still set up and pointed the operation and provisioned the infrastructure behind it, the command-and-control server, the staging server used for the stolen data and chose a victim.” The root credentials used against the victim’s database were not harvested by the agent; they came from a prior compromise and were handed to the operation. The agent owned the technical execution. The human owned targeting and logistics.
Two further clarifications matter. The OpenAI, Anthropic, DeepSeek, and Gemini API keys found in the operation were loot the agent stole from the Langflow host, Clark told TechCrunch, not evidence of which model was driving. And Sysdig was unable to identify the model behind the agent at all; it has no visibility into its system prompt or configuration. Microsoft researcher Geoff McDonald has argued an open-weight model with safety training stripped out is the likeliest candidate, based on his red-teaming experience with frontier-lab safety layers. Sysdig’s account neither confirms nor rules that out. The human-in-the-loop detail also tempers the “thousands of simultaneous campaigns” scenario: if every operation needs a human to pick the victim and source credentials, that is a bottleneck, for now.
Why is the data unrecoverable?
The AES key was generated as base64(uuid4().bytes + uuid4().bytes), which is effectively random, printed to stdout, and never persisted or transmitted. That is a critical detail. In a normal extortion play the operator keeps the key so they can sell decryption. Here the key evaporated the moment the process ended. The victim cannot recover the 1,342 encrypted Nacos configurations even if they pay, because there is nothing left to decrypt with. Whether that was a deliberate destructive choice or an agent’s careless implementation, the outcome is the same: this was a wiper wearing an extortion note.
It is a familiar pattern for anyone following the shift toward pure-extortion and data-destruction tactics in 2026. Encryption that cannot be reversed removes the last incentive to pay while keeping all the operational pressure.
What does this mean for defenders?
The immediate lesson is that internet-facing AI tooling is now a first-class attack surface. JADEPUFFER’s entry point was a Langflow instance, an LLM app-builder, exposed to the internet with a known CVE. Nacos and MinIO fell to default credentials and an old auth-bypass bug. None of that is exotic. The novelty is the operator, not the vulnerabilities. Patch your AI infrastructure with the same urgency as any other edge service, kill default credentials, and segment production databases away from experimental AI hosts.
The strategic lesson is harder. If an agent can run the full kill chain, the volume of low-skill attacks will rise and the dwell time will shrink. Detection has to shift toward behaviour: rapid, iterative, automated action against databases and configuration stores is now a signal in itself. Teams hardening their MCP and agent attack surface should assume the same autonomy that helps their own agents will be turned against them. Reliable, offline backups remain the one control that survives an unrecoverable encryptor.
Frequently asked questions
Is JADEPUFFER the first AI ransomware?
JADEPUFFER is the first documented case of a ransomware operation whose technical execution was run end to end by an AI agent, according to Sysdig. Earlier “AI ransomware” reports still involved a human directing the tooling at every step.
Was JADEPUFFER fully autonomous?
No. Sysdig clarified that a human handler chose the victim, provisioned the command-and-control and staging infrastructure, and supplied stolen root database credentials from a prior compromise. The agent handled the technical intrusion itself.
What vulnerability did JADEPUFFER exploit first?
The agent gained initial access through CVE-2025-3248, a flaw in internet-facing Langflow instances. It later exploited CVE-2021-29441, a Nacos authentication bypass, to create rogue administrator accounts.
Can victims recover data encrypted by JADEPUFFER?
No. The encryption key was random, printed to stdout, and never saved or transmitted, so the encrypted configurations cannot be restored even if a ransom is paid. Offline backups are the only recovery path.
How did researchers know an AI agent ran the attack?
The payloads were self-narrating with natural-language reasoning and verbose annotations typical of LLM-generated code, and the operation adapted at machine speed, once fixing a failed login in 31 seconds.
Which AI model ran the JADEPUFFER attack?
Unknown. Sysdig could not identify the model driving the agent, and the OpenAI, Anthropic, DeepSeek, and Gemini API keys found in the operation were stolen loot, not the engine. One Microsoft researcher suspects an open-weight model with safety training removed.
Does JADEPUFFER mean anyone can run ransomware now?
It lowers the barrier significantly. Because the agent chained reconnaissance, credential theft, lateral movement, and destruction without expert input, an operator no longer needs deep skill in any single step to run a working campaign.
Sources and further reading
- Sysdig: JADEPUFFER, agentic ransomware for automated database extortion
- TechCrunch: The ‘first’ AI-run ransomware attack still needed a human
- BleepingComputer: JadePuffer ransomware used AI agent to automate entire attack
- CyberScoop: Sysdig clocks first documented case of agentic ransomware
- Ransomnews: Agentic AI threats: how MCP becomes an attack chain
- Ransomnews: 62% of database ransom wallets were never paid
The Ransomnews Monthly
One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.
Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.