Sysdig found something that sounds like a sci-fi plot: a ransomware attack planned and executed from start to finish by an AI agent, no human driver at the wheel.
They’re calling the operator JADEPUFFER. A large language model handled the whole chain — breaking in, stealing credentials, moving laterally, then encrypting and wiping a production database.
The entry point was old news. The agent exploited CVE-2025-3248, a missing-authentication bug in Langflow, an open-source tool for building AI workflows. The flaw lets anyone who reaches the server run their own Python code. No login required.
Langflow fixed this in version 1.3.0. CISA added it to the Known Exploited Vulnerabilities list in May 2025. But plenty of servers never got updated. That’s the pattern here: old bugs on exposed boxes.
Once inside, the agent moved fast. It mapped the machine. It scraped API keys for OpenAI, Anthropic, DeepSeek, Gemini, and cloud credentials for AWS, Azure, Google, Alibaba, and Tencent. It found a MinIO storage server still using factory-default credentials (minioadmin:minioadmin). It set up a scheduled task beaconing home every 30 minutes.
Then it pivoted to a MySQL database running alongside Alibaba’s Nacos service directory. It logged in as root — Sysdig never determined where those credentials came from. From there, it used CVE-2021-29441, an authentication bypass in Nacos, plus a default signing key unchanged since 2020, to plant its own admin account.
The encryption phase was the strangest part. The agent encrypted 1,342 Nacos settings, dropped the original tables, and left a ransom note demanding Bitcoin. It generated a random encryption key, printed it once, and never saved or sent it anywhere. There is no key to recover. Paying does nothing.
Sysdig identified the attack as AI-driven because of the code itself: plain-English commentary explaining each step — something a human wouldn’t write but a model produces by default. The agent fixed its own mistakes at machine speed, going from a failed login to a correct fix in 31 seconds.
The message for defenders: this was not clever. Every individual move was a known technique against known bugs. What changed is that a model can now stitch them together autonomously. Patch Langflow, harden Nacos, change default credentials, lock down outbound traffic, and assume any exposed server will be probed by a machine, not just a person.
