AI Didn’t Just Assist—It Ran the Whole Show
Cloud security firm Sysdig has published details on what it calls the first ransomware campaign executed entirely by a large language model. No human hands on the keyboard. No experienced operator steering the malware.
Dubbed JadePuffer, the campaign exploited CVE-2025-3248 in an internet-facing Langflow instance. From there, the LLM agent ran an adaptive, fully automated playbook that ended with a devastating database extortion attack against a production server.
The attack took just 31 seconds to recover from a failed login attempt and keep moving. That speed is the new reality.
How JadePuffer Worked: A Multi-Stage, Self-Correcting Attack
Sysdig’s Threat Research Team described a campaign that didn’t rely on a human-driven toolkit. Instead, an LLM agent delivered all attack capabilities autonomously, retrying failed steps within refined parameters until it succeeded.
The multi-stage assault unfolded like this:
- Exploited Langflow via CVE-2025-3248 to gain initial access
- Conducted reconnaissance and harvested credentials—LLM API keys, cloud credentials, database logins
- Stole local data, including Langflow’s own backing Postgres database
- Mapped laterally to discover other services reachable from the compromised host
- Enumerated a MinIO object store and grabbed more credentials
- Created a cron job on the Langflow server for persistence
- Gained access to a production MySQL server running Alibaba Nacos using root credentials
- Targeted Nacos with multiple payloads, including exploitation of CVE-2021-29441
The goal wasn’t just extortion. It was mass data destruction.
Data Destroyed, Not Just Held Hostage
JadePuffer encrypted all 1,342 Nacos service configuration items and deleted the originals. But here’s the kicker: the AES key was generated as base64(uuid4().bytes + uuid4().bytes)—essentially random—and printed to stdout. It was never persisted or transmitted anywhere.
“The victim cannot recover the encrypted configurations even with payment,” Sysdig explained.
Captured payloads show the LLM escalating from row-level deletion to dropping entire database schemas, all while narrating its own targeting rationale. The IP address 64.20.53[.]230 only appears in this context, with no evidence that anything was backed up to it.
Four Takeaways for Security Teams
Sysdig highlighted four critical lessons from the JadePuffer discovery:
1. Ransomware No Longer Requires Skilled Operators
An LLM agent can carry out reconnaissance, credential theft, lateral movement, persistence, and destruction without any human expertise. The barrier to entry just dropped to zero.
2. Old Vulnerabilities Are Being Automated
This attack leaned on years-old issues: a 2021 Nacos auth-bypass and an unchanged default signing key. Neglected, internet-exposed infrastructure is a goldmine for agentic attackers.
3. New Detection Opportunities Emerge
An LLM narrates its own objectives in its payloads. That provides a new detection and triage opportunity for network defenders—if they’re paying attention.
4. Exfiltration Claims Are the Agent’s Own Assertion
The AES key was ephemeral and unrecoverable. The victim’s configurations are gone forever, even if a ransom were paid. There’s no leverage, only destruction.
The Age of Agentic Threat Actors Is Here
Heath Renfrow, co-founder and CISO at breach recovery firm Fenix24, warned that agentic threat actors (ATAs) will compress the time defenders have to respond.
“If an AI agent can compress what previously took an experienced operator several hours into a matter of minutes, defenders lose valuable time. That has implications across every phase of an incident, from detection and containment to recovery,” he said.
Renfrow urged organizations not to get distracted by whether an attacker is “AI-powered.” The outcome is the same: compromised identities, stolen credentials, encrypted or destroyed data, and business disruption.
“Security teams should continue prioritizing the fundamentals—rapid patching of internet-facing systems, strong identity protections, least privilege, network segmentation, continuous monitoring, and restricting unnecessary external exposure,” he added.
For more on AI-driven threats, read our coverage of the first reported AI-powered ransomware and how LLMs are reshaping cyberattacks.
