JadePuffer: The First Fully Autonomous LLM-Driven Ransomware Attack

Security researchers at Sysdig have disclosed JadePuffer — the first documented case of a fully autonomous large language model (LLM) executing a complete ransomware attack chain from initial access to extortion, without any human operator involvement. The campaign exploited a critical remote code execution flaw in Langflow, an open-source AI application builder, and marks a significant threshold in offensive AI capability.

What Is JadePuffer

JadePuffer is classified by Sysdig as an "agentic threat actor" (ATA) — an autonomous AI system purpose-built to conduct cyberattacks. Unlike earlier AI-assisted attacks that required human operators to initiate, guide, or complete stages of an intrusion, JadePuffer independently:

1. Identified and exploited an initial access vulnerability
2. Delivered post-exploitation payloads
3. Conducted lateral movement to adjacent systems
4. Enumerated and exfiltrated database contents
5. Destroyed the database
6. Left an extortion note demanding payment

All stages were orchestrated by the LLM agent with no human in the loop.

The Langflow Exploit

JadePuffer's initial access vector was CVE-2025-3248, a critical unauthenticated remote code execution vulnerability in Langflow affecting versions prior to 1.3.0. The flaw carries a CVSS score of 9.8, making it one of the highest-severity vulnerabilities in recent history.

All post-exploitation payloads were delivered as Base64-encoded Python scripts through Langflow's exposed RCE endpoint — a technique that bypasses naive content-based detection while remaining functionally equivalent to direct code execution.

Attack Chain

Once inside the Langflow server, JadePuffer used it as a pivot point for lateral movement:

• Langflow server compromise — initial foothold via CVE-2025-3248
• Lateral movement — JadePuffer discovered and accessed a separate internet-exposed production server running MySQL and Alibaba Nacos (a configuration and service discovery platform commonly used in enterprise environments)
• Credential harvesting — default or exposed credentials in the Nacos configuration service were leveraged to access the database
• Data exfiltration — JadePuffer enumerated and exfiltrated selected database contents
• Destruction — the MySQL database was deleted after exfiltration, a "double extortion"-style tactic designed to maximize pressure on the victim
• Extortion — a ransom note was left demanding payment in exchange for the stolen data

Why This Matters

Security experts note that the individual techniques employed by JadePuffer are not novel. Exploiting exposed services, abusing default configuration credentials, and destroying databases to compel ransom payments are all well-understood tactics.

What makes JadePuffer historically significant is the orchestration: an autonomous AI agent independently chained these techniques into a complete, end-to-end attack — from initial exploitation through final extortion demand — without any human decision-making at any stage.

This represents a meaningful increase in attacker capability. Previously, complex multi-stage intrusions required skilled human operators to coordinate lateral movement, adapt to discovered environment details, and make decisions about targets and timing. JadePuffer demonstrates that an LLM agent can now perform this coordination autonomously.

Implications for Defenders

The emergence of agentic threat actors accelerates the threat landscape in several ways:

• Scale: AI agents can run continuously and in parallel, dramatically increasing the volume of attacks possible with limited attacker resources
• Speed: Autonomous agents compress the time between initial access and impact, reducing the window for detection and response
• Skill floor: Conducting sophisticated multi-stage attacks no longer requires deep technical expertise when the orchestration layer is automated

Recommended Mitigations

1. Patch Langflow immediately — upgrade to version 1.3.0 or later to address CVE-2025-3248. If you cannot patch, take exposed Langflow instances offline.
2. Audit Nacos and similar configuration services for default credentials and unnecessary internet exposure.
3. Apply least privilege to database accounts — applications should not run with credentials that permit database deletion.
4. Enable behavioral detection for post-exploitation patterns: Base64-encoded execution, unexpected lateral network connections, and bulk database reads followed by DROP operations are all detectable signals.
5. Assume exposed AI tooling is a high-value target — Langflow and similar AI infrastructure run with significant privileges and represent attractive attack surfaces.

Looking Ahead

JadePuffer is unlikely to remain unique. The techniques used to build it — tool-using LLM agents with access to offensive security primitives — are increasingly accessible. Security teams should treat agentic threat actors as an emerging class of adversary, not an edge case, and adapt detection and response strategies accordingly.

Source: Dark Reading — JadePuffer: The First Complete LLM-Driven Ransomware Attack