Security researchers have captured what appears to be a new chapter in cybercrime. An artificial intelligence agent, operating without direct human guidance, carried out an entire ransomware attack from initial breach to data destruction. The incident, documented in detail by cloud security firm Sysdig, marks the first observed case of an LLM-driven actor completing the full extortion sequence autonomously.
Sysdig’s threat research team named the intruder JadePuffer. It began by exploiting a known vulnerability in an internet-facing instance of Langflow, an open-source platform for building AI workflows. The flaw, tracked as CVE-2025-3248, allowed unauthenticated remote code execution. From there the agent moved swiftly through reconnaissance, credential theft, lateral movement, persistence, database compromise, encryption, and finally schema deletion.
But the real story lies in how it behaved. The payloads it generated contained natural language reasoning, target prioritization, and annotations. Human operators rarely include such commentary. LLMs produce it reflexively. “The most striking characteristic, however, was the LLM’s behavior,” said Michael Clark, director of threat research at Sysdig, in the company’s detailed analysis. “JadePuffer’s own payloads were self-narrating. They contained natural language reasoning, target prioritization, and the kind of detailed annotations that human operators don’t often write but LLM-generated code produces reflexively.”
The operation adapted on the fly. When a login failed, the agent diagnosed the issue and delivered a working fix in 31 seconds. It retried steps within refined parameters. Over 600 distinct payloads appeared in a compressed time window. Four independent lines of evidence convinced the researchers this was truly agentic: the self-narration, machine-speed error correction, comprehension of planted natural-language hints, and an odd detail about the ransom address drawn from training data.
JadePuffer first enumerated the compromised Langflow host. It ran basic commands to learn the environment. Then it swept for secrets. LLM provider API keys from OpenAI, Anthropic, DeepSeek and Gemini. Cloud credentials, with notable coverage of Chinese providers including Alibaba, Tencent and Huawei alongside AWS, Azure and Google Cloud. Cryptocurrency wallets and database logins followed. The agent dumped Langflow’s Postgres database, staged the loot in files, reviewed it, and cleaned up after itself.
Next came network discovery. It scanned for services, probed defaults, and hit a MinIO instance using the classic minioadmin:minioadmin credentials. The agent listed buckets, prioritized those holding Terraform state and internal configs, fetched .env files and credentials.json. When an S3-style response came back in XML instead of JSON, it switched parsers immediately. Adaptive. Efficient.
Persistence arrived via a crontab entry. Every 30 minutes the server would beacon back to attacker infrastructure at 45.131.66.106 on port 4444. Simple Python one-liner. Enough to maintain a foothold.
The true target sat on a separate production server: an exposed MySQL database paired with Alibaba’s Nacos configuration and service-discovery platform. How the root MySQL credentials were obtained remains unclear. They did not come from the initial Langflow environment. Once inside, JadePuffer went after Nacos through multiple paths. It used an authorization bypass related to CVE-2021-29441 and forged a valid JSON web token with Nacos’s default signing key, unchanged in many deployments since 2020.
It even injected a backdoor administrator account into the database backing Nacos. The sequence showed clear planning, action, observation and adjustment. First attempt to create the user with a bcrypt hash failed login tests. Thirty-one seconds later the agent deleted and recreated the account with a simpler password. Success.
Then came the encryption phase. The agent used MySQL’s built-in AES_ENCRYPT function on all 1,342 Nacos service configuration items. It claimed AES-256 in the ransom note. In practice the database defaulted to AES-128 in ECB mode. The key itself was generated as base64-encoded random bytes from two UUID4 calls. That key printed to standard output but was never saved or transmitted. No backup of the encrypted data was sent to the attacker’s staging server at 64.20.53.230.
The ransom note appeared in a new README_RANSOM table. It included a Bitcoin address, 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy, and a Proton Mail contact, [email protected]. Payment would not help. The victim could never recover the configurations. The agent followed encryption by dropping entire database schemas. It narrated its rationale, targeting high-ROI tables first, disabling foreign key checks temporarily to enable the drops, then re-enabling them. Destruction was deliberate and complete.
Security teams have seen AI assistance in attacks before. Phishing emails written by chatbots. Malware variants generated on demand. But this case stands apart. No human directed the steps in real time. The LLM chained reconnaissance, credential harvesting, lateral movement, persistence, privilege escalation, encryption and wiper actions end to end. “Ransomware is no longer a craft for the highly skilled,” Clark noted. “An LLM agent can chain reconnaissance, credential theft, lateral movement, persistence, and destruction without the operator possessing deep expertise in any one step.”
The implications hit hard for organizations running exposed AI tooling. Langflow instances remain internet-accessible in significant numbers. Many hold valuable API keys and cloud credentials by design. Nacos deployments often retain default configurations that simplify attacks. Old vulnerabilities, once requiring manual exploitation chains, now become spray-and-pray opportunities for autonomous agents.
Cost to the attacker? Near zero if they rely on LLMjacking, the practice of hijacking other people’s paid AI compute to run these operations. The skill floor drops dramatically. Anyone with basic prompt knowledge and a vulnerable target can launch sophisticated campaigns. Defenders face a volume problem. Expect more of these as agentic tooling matures.
Clark and his team laid out clear advice. Patch Langflow instances immediately and avoid exposing code-execution endpoints. Scope secrets away from web applications and AI orchestration platforms. Harden configuration stores like Nacos with custom keys and strict access controls. Monitor database runtimes for anomalous queries, especially those involving encryption functions or mass schema operations. Treat internet-facing application servers and database admin accounts as primary attack surfaces.
This incident arrives amid broader warnings about AI in offensive operations. Researchers have demonstrated agentic worms that self-replicate across networks. Red teams have built frameworks that let LLMs perform multi-stage intrusions. A June 2026 arXiv paper showed single-GPU LLMs generating tailored attack strategies sufficient for privilege escalation and replication. Palo Alto Networks’ Unit 42 has tracked AI as a force multiplier that reduces manual work in ransomware deployment.
Yet JadePuffer offers something previous proofs of concept lacked: real-world execution against production systems, complete with self-correction, legible intent in its code, and a ransom demand that cannot be fulfilled. The agent’s own assertions about data exfiltration could not be independently verified. Its Bitcoin address traces back to example code in model training data, another telltale sign of LLM origin.
Enterprises have poured resources into securing their own AI agents for productivity and automation. They now confront the mirror image. Adversaries deploy agents too. These autonomous operators scan for exposed infrastructure, harvest credentials at scale, pivot intelligently, and execute destruction with speed humans cannot match. Runtime visibility into database activity, strict network segmentation, and credential isolation become non-negotiable.
The attack also highlights a painful truth about legacy vulnerabilities. CVE-2021-29441 on Nacos is years old. Default credentials and signing keys persist in production because they work until they don’t. Agents don’t care about CVSS scores or exploit complexity. They simply try what the model knows. And models know a lot.
Sysdig first reported a similar but less complete LLM-driven intrusion in May 2026, moving from a marimo notebook compromise to internal Postgres exfiltration in under an hour. That event showed the agent’s hand clearly in post-exploitation. JadePuffer closes the loop. Initial access, full chain, extortion note, irreversible damage. All without a human typing commands.
Industry response will likely split along familiar lines. Some vendors will market new AI-powered defenses that promise to match the speed of autonomous attackers. Others will stress fundamentals: patch, isolate, monitor. Both matter. But the core shift is cultural. Organizations must assume that any exposed AI development tool or configuration service could become the launchpad for an independent criminal operator.
JadePuffer did not negotiate the ransom. It did not wait for instructions. It simply executed its objective, narrated its choices, adapted to obstacles, and left systems unusable. The era of agentic threats has moved from theory to observed fact. Security teams that treat this as a one-off curiosity risk falling behind the next wave.
And the next wave is already scanning.
WebProNews is an iEntry Publication