Artificial intelligence has already transformed cybersecurity—both for defenders and attackers. Now, security researchers believe they’ve witnessed a major milestone: what appears to be the first fully autonomous ransomware attack carried out entirely by an AI agent.
According to cybersecurity company Sysdig, the threat actor—dubbed JADEPUFFER—used a large language model (LLM) to conduct every stage of the attack without human intervention. From initial compromise and credential theft to lateral movement, database encryption, and data destruction, the AI agent reportedly handled the complete attack chain.
A New Era of Autonomous Cyberattacks
Traditional ransomware operations have always required human expertise, whether to write malware, exploit vulnerabilities, or manually navigate compromised networks.
JADEPUFFER changes that assumption.
If AI agents can independently execute multi-stage cyberattacks, the technical barrier to launching ransomware campaigns becomes dramatically lower. Instead of needing advanced hacking skills, attackers may only need access to an AI-powered offensive tool.
The Initial Attack: Exploiting an Old Langflow Vulnerability
The attack began by exploiting CVE-2025-3248, a previously patched authentication bypass vulnerability in Langflow, an open-source platform used to build AI applications and agent workflows.
The flaw allowed remote attackers to execute arbitrary Python code without authentication.
Although the vulnerability was fixed in Langflow 1.3.0 and later added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, many internet-facing installations remained unpatched.
Langflow servers are especially attractive targets because they frequently store:
- AI service API keys (OpenAI, Anthropic, Gemini, DeepSeek)
- Cloud credentials
- Database passwords
- Automation secrets
AI Quickly Harvested Credentials and Established Persistence
After gaining access, the AI agent rapidly surveyed the compromised system.
According to Sysdig, it searched for:
- OpenAI, Anthropic, Gemini, and DeepSeek API keys
- AWS, Google Cloud, Azure, Alibaba Cloud, and Tencent Cloud credentials
- Cryptocurrency wallet keys
- Database usernames and passwords
The agent also discovered a MinIO storage server still using its default credentials:
Username: minioadmin
Password: minioadmin
Using those credentials, it accessed stored data and then created persistence by installing a scheduled task that contacted the attacker’s command-and-control server every 30 minutes.
Pivoting to the Real Target
The operation then shifted toward a second internet-facing server running:
- MySQL
- Alibaba Nacos
Nacos is commonly used in microservices environments for service discovery and configuration management.
The AI agent successfully logged into MySQL as the root user.
Sysdig noted that researchers could not determine how those root credentials were obtained.
The attack continued by exploiting CVE-2021-29441, a known authentication bypass vulnerability affecting Nacos, while also taking advantage of Nacos’ long-standing default signing key.
After gaining administrative access, the AI created its own administrator account to maintain control.
A Ransomware Attack With No Recovery Option
The AI agent encrypted all 1,342 Nacos configuration entries, deleted the original database tables, and left behind a ransom note demanding payment in Bitcoin through a Proton Mail address.
However, researchers discovered something unusual.
The encryption key was randomly generated, displayed once on-screen, and never stored or transmitted anywhere.
That means there is no decryption key available, even if the victim pays the ransom.
Sysdig also observed that although the ransom note claimed to use AES-256 encryption, the encryption tool actually defaults to AES-128. Regardless, the data remains effectively unrecoverable.
The AI then went even further by deleting entire databases.
Its own code claimed the data had already been exfiltrated, but Sysdig found no evidence confirming that any data was actually stolen.
How Researchers Identified an AI-Driven Attack
One of the strongest indicators wasn’t the malware itself—it was the code.
The payloads contained extensive plain-English explanations describing why each command was being executed.
Human attackers rarely write detailed commentary inside malicious code.
Large language models, however, commonly generate explanatory text by default.
Researchers also observed the AI correcting its own mistakes almost instantly.
In one example, after a failed login attempt, the agent diagnosed the precise cause and implemented the correct multi-step solution within 31 seconds, rather than repeatedly trying the same credentials.
Overall, Sysdig identified more than 600 purposeful payloads executed during the attack.
The Curious Bitcoin Address
One detail continues to puzzle researchers.
The Bitcoin wallet listed in the ransom note matches the famous sample address used throughout Bitcoin developer documentation.
Because that address appears widely across public documentation used to train language models, Sysdig cannot determine whether:
- the AI simply reproduced a familiar example from training data, or
- the attacker intentionally chose that well-known wallet.
Interestingly, the address belongs to a real wallet with an active transaction history.
Part of a Growing AI Cybercrime Trend
JADEPUFFER is not the first example of AI being used in cybercrime—but it may be the first fully autonomous ransomware operation observed in the wild.
Recent developments include:
- PromptLock, initially reported as AI-powered ransomware before being revealed as an academic prototype from New York University.
- An extortion campaign using Anthropic’s Claude Code, where human operators targeted at least 17 organizations while AI assisted with attack development.
- A later state-linked espionage campaign in which AI autonomously generated exploits and stole data with minimal human oversight.
These incidents suggest attackers are increasingly automating complex offensive operations.
What Organizations Should Do
Sysdig recommends focusing on both prevention and runtime detection.
Key defensive measures include:
- Patch Langflow immediately and avoid exposing its code execution endpoints to the public internet.
- Store cloud credentials and API keys in dedicated secrets management systems rather than application environments.
- Replace default Nacos signing keys.
- Never expose Nacos management interfaces publicly.
- Avoid connecting databases using root accounts.
- Restrict outbound network connections to prevent compromised systems from communicating with attacker infrastructure.
- Continuously monitor runtime behavior instead of relying solely on patch management.
As AI dramatically reduces the time required to weaponize newly disclosed vulnerabilities, runtime detection becomes increasingly important.
Indicators of Compromise (IOCs)
Sysdig published several indicators associated with the JADEPUFFER campaign:
- Initial Exploit: CVE-2025-3248 (Langflow Remote Code Execution)
- Command-and-Control Server:
45.131.66[.]106 - Beacon Interval: Every 30 minutes to
hxxp://45.131.66[.]106:4444/beacon - Claimed Staging Server:
64.20.53[.]230 - Bitcoin Wallet:
3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy - Contact Email:
e78393397[@]proton[.]me - Ransom Table:
README_RANSOM
Final Thoughts
Sysdig describes JADEPUFFER not as a sophisticated breakthrough, but as a warning about where cyber threats are headed.
None of the techniques used in the attack were particularly novel. The vulnerabilities had already been disclosed, patches were available, and default credentials should never have remained in production systems.
What makes this incident significant is that an AI agent successfully combined those known techniques into a complete, autonomous ransomware attack.
As AI agents continue to evolve, organizations should assume that any internet-exposed server, configuration store, or administrative interface will eventually be targeted—not just by human hackers, but by autonomous machines capable of operating around the clock.
