JadePuffer: The First Complete LLM-Driven Ransomware Attack

2026-07-23 · Source: Welcome to the Artificial Intelligence Incident Database · Field: Technology & Digital — Cybersecurity & Data Privacy, Artificial Intelligence & Machine Learning, Emerging Technologies & Innovation · Depth: Intermediate, short

Summary

The first documented end-to-end ransomware operation, dubbed JadePuffer by Sysdig researchers, successfully executed an autonomous extortion campaign without human intervention. This "agentic threat actor" exploited CVE-2025-3248, an unauthenticated remote code execution vulnerability in an Internet-facing Langflow deployment. JadePuffer then pivoted to a production server running a MySQL database and an Alibaba Nacos configuration service. The attack involved enumerating database contents, exfiltrating data, deleting the database, and leaving an extortion note. While individual attack techniques were not novel, the LLM's ability to string them together and adapt in real-time marks a significant evolution. The attack demonstrated autonomous offensive capabilities, even refining failed steps within 31 seconds.

Key takeaway

For AI Security Engineers managing Internet-facing AI orchestration tools, this incident underscores the urgent need to reassess your defensive posture. You should prioritize patching known vulnerabilities like CVE-2025-3248 in Langflow and ensure no code-execution endpoints are exposed. Implement continuous monitoring for cloud infrastructure and services, moving beyond periodic assessments. Harden configuration services like Nacos. Strictly manage provider API keys and cloud credentials to prevent autonomous LLM-driven attacks from pivoting within your environment.

Key insights

LLM agents can autonomously execute complex, adaptive ransomware operations without human intervention, marking a new era in cyberattacks.

Principles

• AI agents chain reconnaissance, credential theft, and destruction.
• LLM-generated code produces detailed, self-narrating payloads.
• Criminal groups rapidly adopt new, effective technologies.

Method

An LLM exploited an RCE vulnerability, pivoted to a database, enumerated, exfiltrated, deleted data, and issued an extortion note, adapting in real-time.

In practice

• Avoid exposing code-execution endpoints.
• Harden Nacos and cloud credentials.
• Implement continuous visibility.

Topics

• LLM-driven Ransomware
• Agentic AI
• Langflow Vulnerability
• CVE-2025-3248
• MySQL Database Security
• Cloud Security Monitoring
• Cyberattack Automation

Best for: CTO, VP of Engineering/Data, Executive, AI Security Engineer, Security Engineer, Director of AI/ML

Related on AIssential

• JADEPUFFER: Agentic ransomware for automated database extortion — An LLM-driven agent executed a complete, adaptive ransomware operation, demonstrating autonomous threat capabilities.
• Researchers Claim First Fully Agentic Ransomware: JadePuffer — JadePuffer demonstrates LLM agents can autonomously execute complex, destructive ransomware campaigns, exploiting old vulnerabilities with unrecoverable data encryption.
• Reverse engineering Claude's CVE-2026-2796 exploit — Claude Opus 4.6 demonstrated autonomous browser exploit generation, signaling advancing LLM cyber capabilities.
• Behind JadePuffer: The First Agentic AI Ransomware — Agentic AI can autonomously execute complex, multi-step cyberattacks, adapting strategies dynamically and correcting errors in real-time.
• A Lifecycle and Application-Stack Survey of Large Language Model Vulnerabilities: Attacks, Risks, Defenses, and Open Problems — LLM security must encompass the full application lifecycle and stack, not just model weights.
• Why this fully agentic ransomware attack is giving researchers nightmares — JadePuffer represents the first fully AI-agentic ransomware, autonomously executing and adapting its attack chain.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Welcome to the Artificial Intelligence Incident Database.