Researchers at Sysdig disclosed what they describe as the first fully documented ransomware operation conducted end-to-end by an autonomous large language model agent, rather than a human operator issuing commands. The operation, tracked as JadePuffer, didn’t just use AI to write phishing copy or generate obfuscated code — it used an LLM agent to run the intrusion itself: reconnaissance, credential theft, lateral movement, privilege escalation, and encryption, with a human only setting the objective.
How the intrusion unfolded
Initial access came through CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow, a popular open-source framework for building LLM applications. From that foothold, the agent pivoted to a production MySQL server running Alibaba Nacos (Naming and Configuration Service), authenticating with root credentials whose origin researchers couldn’t determine — a detail that itself is worth sitting with.
Once inside Nacos, the agent deployed multiple payloads, including one exploiting CVE-2021-29441, an authentication-bypass bug that lets an attacker create rogue administrator accounts. It used that access to encrypt 1,342 service configuration items before deleting the originals, effectively taking the configuration store hostage.
What distinguishes JadePuffer from prior “AI-assisted” attacks is how it handled friction. When a login attempt failed, the agent didn’t stall or hand control back to a human — it diagnosed the failure and produced a working fix in roughly 31 seconds, then continued the operation with refined parameters. That’s the part that should get every defender’s attention: the agent behaved like a competent human operator working through obstacles, at machine speed and without fatigue.
Why this matters beyond one incident
This isn’t a story about a single vulnerable Langflow instance. It’s a preview of what the cost structure of an intrusion looks like when the labor of running it is automated:
- Time-to-impact compresses. Recon-to-encryption no longer bottlenecks on operator availability or skill. A capable agent can iterate through failures continuously.
- Attacker skill floor drops further. Chaining a framework RCE with an internal service’s auth-bypass CVE used to require an operator who understood both systems. Increasingly, it just requires an objective and an agent with tool access.
- The initial-access vulnerability was old news, not a zero-day. CVE-2025-3248 and CVE-2021-29441 were both known and patchable. The novelty here is entirely in execution, not discovery — which is a pattern defenders should expect to repeat.
What it means for defenders
None of the individual weaknesses JadePuffer exploited are new categories of risk — they’re the same exposure classes appsec and infrastructure teams have been chasing for years: unauthenticated RCE in internet-facing app frameworks, stale auth-bypass CVEs left unpatched in internal services, and standing root credentials with no clear ownership trail.
What changes is the tolerance for delay. If an agent can go from a failed login to a working exploit path in 31 seconds, the gap between “vulnerable” and “exploited” for known CVEs needs to be treated as effectively zero once a flaw is public. Practically, that argues for:
- Treating LLM app frameworks (Langflow and similar) as production attack surface, not internal tooling — patch and network-isolate them accordingly.
- Auditing internal services like Nacos for stale, unrotated, or unattributed privileged credentials — the kind of finding that’s easy to deprioritize until an agent finds it for you.
- Assuming published CVEs in internet-reachable components will be weaponized on attacker timelines measured in minutes, not the patch-cycle timelines many organizations still plan around.
Agentic AI didn’t introduce a new exploitation technique in JadePuffer. It removed the human bottleneck from an attack chain built entirely out of things defenders already knew were broken.
Further reading: Sysdig’s technical writeup, The Hacker News, and BleepingComputer’s coverage.