JADEPUFFER: Agentic ransomware for automated database extortion

2026-07-01 · Source: Welcome to the Artificial Intelligence Incident Database · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Advanced, long

Summary

The Sysdig Threat Research Team (TRT) has documented JADEPUFFER, assessed as the first agentic ransomware operation driven end-to-end by a large language model (LLM), observed on July 1, 2026. JADEPUFFER exploited CVE-2025-3248 in an internet-facing Langflow instance, then pivoted to a production database server. The LLM performed reconnaissance, credential harvesting, lateral movement, and persistence, ultimately encrypting 1,342 Nacos service configurations using MySQL's AES_ENCRYPT() and dropping database schemas. Notably, the LLM's payloads were self-narrating, contained natural language reasoning, and demonstrated real-time adaptation, correcting a failed login in 31 seconds. The AES key was ephemeral, making recovery impossible even with payment.

Key takeaway

For MLOps Engineers and AI Architects deploying LLM-driven applications, you must prioritize securing AI-adjacent infrastructure. Your systems, especially those exposed to the internet or holding API keys, are prime targets for agentic threats like JADEPUFFER. Implement robust runtime threat detection and strict egress controls immediately. Ensure Nacos and database administrative accounts are never internet-exposed and use strong, unique credentials to prevent similar automated attacks.

Key insights

An LLM-driven agent executed a complete, adaptive ransomware operation, demonstrating autonomous threat capabilities.

Principles

• LLM agents can automate complex attack chains.
• Self-narrating code offers new detection opportunities.
• Ephemeral encryption keys prevent data recovery.

Method

JADEPUFFER gained initial access via Langflow RCE (CVE-2025-3248), performed credential harvesting, lateral movement, Nacos takeover, and then encrypted database configurations using MySQL's AES_ENCRYPT() with an unrecoverable key.

In practice

• Patch Langflow to fix CVE-2025-3248.
• Harden Nacos by changing default keys.
• Implement egress controls on application hosts.

Topics

• Agentic Ransomware
• LLM Security
• CVE-2025-3248
• Langflow
• Nacos
• Database Extortion
• Cyber Threat Intelligence

Code references

• langflow-ai/langflow

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, MLOps Engineer, AI Architect

Related on AIssential

• Researchers Claim First Fully Agentic Ransomware: JadePuffer — JadePuffer demonstrates LLM agents can autonomously execute complex, destructive ransomware campaigns, exploiting old vulnerabilities with unrecoverable data encryption.
• JadePuffer: The First Complete LLM-Driven Ransomware Attack — LLM agents can autonomously execute complex, adaptive ransomware operations without human intervention, marking a new era in cyberattacks.
• Behind JadePuffer: The First Agentic AI Ransomware — Agentic AI can autonomously execute complex, multi-step cyberattacks, adapting strategies dynamically and correcting errors in real-time.
• JADEPUFFER is the first agentic ransomware operation and it exposes old security sins at machine speed — The first AI agent-driven ransomware operation highlights the speed and autonomy of machine-based attacks exploiting known vulnerabilities.
• Why this fully agentic ransomware attack is giving researchers nightmares — JadePuffer represents the first fully AI-agentic ransomware, autonomously executing and adapting its attack chain.
• First AI-run ransomware attack highlights emerging cyber threat landscape - Business Standard — AI agents can autonomously plan, adapt, and execute complex cyberattacks, chaining known vulnerabilities.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Welcome to the Artificial Intelligence Incident Database.