JadePuffer: The World’s First Fully Autonomous AI Ransomware Has Arrived — And It Needs No Human Operator

In nearly three decades of tracking threat actors, there has always been a human operator somewhere in the loop — writing the payload, issuing the commands, choosing the target. That era may now be over. Between 1 and 6 July 2026, researchers at Sysdig’s Threat Research Team documented an attack campaign called JADEPUFFER: the world’s first confirmed ransomware operation executed entirely by a large language model agent, from initial access to encryption and extortion — with no human operator directing each step. For IT leaders and security teams across India and beyond, this is not a proof-of-concept. It is an operational threat that demands an immediate response.

What Is JADEPUFFER?

JADEPUFFER is not a new malware family in the traditional sense. It is a campaign built around a weaponised AI agent — a system in which a large language model autonomously selects tools, adapts to errors, and chains together techniques that would previously require human expertise at each stage. BleepingComputer and The Hacker News both confirmed Sysdig’s findings independently. The campaign targets organisations running Langflow, the open-source visual IDE for building LLM-powered applications — a toolchain that has exploded in adoption across India’s fast-growing AI startup ecosystem.

What makes JADEPUFFER historically significant is that it collapsed the entire time-to-impact window. In documented human-operated ransomware intrusions, there is typically a dwell period of days or weeks between initial access and encryption. The JADEPUFFER agent moved from first foothold to encrypted database in a single automated session, adapting in real time when it encountered errors — one failed login was retried with corrected parameters within 31 seconds.

Technical Breakdown: The Eight-Step Autonomous Attack Chain

Understanding how the attack unfolded is essential for building defences. The sequence below is reconstructed from Sysdig’s published research and cross-verified against reports by BleepingComputer and The Hacker News.

Step	Action	Technique / CVE
1	Initial Access	CVE-2025-3248 — unauthenticated RCE via Langflow /api/v1/validate/code endpoint
2	Reconnaissance	Dumped PostgreSQL schema, enumerated host, harvested environment variables
3	Credential Theft	Extracted AI API keys (OpenAI, Anthropic, DeepSeek, Gemini) and cloud credentials from env vars
4	Storage Compromise	Accessed MinIO object store using unchanged default credentials (minioadmin:minioadmin)
5	Persistence	Installed cron job beaconing to attacker infrastructure every 30 minutes
6	Lateral Movement	Pivoted to production MySQL / Alibaba Nacos service registry via stolen root credentials
7	Privilege Escalation	CVE-2021-29441 — Nacos authentication bypass and default signing key abuse to create rogue admin accounts
8	Encryption & Extortion	Encrypted 1,342 Nacos service configs using MySQL’s AES_ENCRYPT(), dropped ransom note table

One detail that Sysdig’s researchers found particularly revealing: the AI agent left plain-English comments in its generated code, explaining its reasoning at each step. This is a hallmark of LLM-generated payloads rather than human-written exploits — and paradoxically, it creates a new detection signal that defenders can use.

It is also worth noting a critical flaw in the attacker’s own implementation: the AES encryption key was generated locally and never transmitted to the threat actor’s infrastructure. This means the attackers themselves could not decrypt the data — a self-defeating error that reveals the campaign was likely an early-stage test of agentic capabilities rather than a financially optimised operation. The next generation of such attacks will almost certainly fix this.

Why India’s AI-Adopting Enterprises Are at Particular Risk

India is now among the largest consumers of Langflow deployments globally, driven by the rapid growth of generative AI startups, AI-augmented BPO operations, and enterprise automation projects. Many of these deployments run on public cloud instances with default credentials, internet-exposed admin APIs, and secrets loaded directly into environment variables — exactly the configuration JADEPUFFER exploited.

The stolen API keys in the JADEPUFFER campaign — for OpenAI, Anthropic, DeepSeek, and Gemini — represent a secondary revenue stream for attackers. AI API credentials can be monetised immediately on underground markets, long before a ransom is ever paid. For organisations spending ₹10–50 lakh per month on AI compute, credential theft alone is a material financial loss.

This campaign also arrives after a pattern we have been tracking on this blog. When an AI agent breached Hugging Face earlier this year, executing 17,000 autonomous actions to steal credentials, many dismissed it as an isolated research curiosity. JADEPUFFER is proof it was a preview. And just as the GodDamn ransomware campaign showed that signed drivers can bypass EDR, JADEPUFFER shows that AI can bypass the human bottleneck in attack operations entirely.

What You Should Do Right Now

The following actions are prioritised by impact and urgency. If you are running Langflow in any environment, items 1 and 2 are non-negotiable today.

1. Patch Langflow immediately. CVE-2025-3248 was fixed in Langflow 1.3.0. CISA’s remediation deadline was 26 May 2025. If you are still running an older version, your /api/v1/validate/code endpoint is a public RCE entry point. Upgrade now or take the service offline.
2. Remove secrets from environment variables. API keys, database credentials, and cloud access tokens must be stored in a dedicated secrets manager (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or equivalent). Never load them as plaintext env vars in an application container.
3. Audit and rotate all AI API keys. If you run Langflow or any LLM-adjacent service, rotate your OpenAI, Anthropic, Google, and DeepSeek API keys immediately. Enable spend alerts and per-key rate limits.
4. Harden Nacos and MinIO. Change the Nacos default token signing key (SecretKey012345678901234567890123456789012345678901234567890123456 is widely known). Change MinIO default credentials away from minioadmin:minioadmin. Neither service should be internet-facing without authentication.
5. Patch CVE-2021-29441 in Nacos. This 2021 authentication bypass was the lateral movement vector in JADEPUFFER. Many organisations still run unpatched Nacos in internal environments, assuming network isolation is sufficient — it is not if an attacker already has a foothold.
6. Deploy runtime behavioural monitoring. Signature-based detection will not catch an LLM agent generating novel payloads on the fly. Look for runtime anomalies: unexpected outbound connections from application containers, cron job creation by web processes, and database encryption operations executed via application accounts.
7. Apply zero-trust segmentation to AI workloads. AI application servers should not have direct access to production databases or storage. Each component should authenticate explicitly, with least-privilege permissions, and outbound connectivity should be whitelisted by destination.

Frequently Asked Questions

Is JADEPUFFER a new malware family, or a new attack technique?

It is primarily a new attack methodology. The underlying vulnerabilities (CVE-2025-3248 and CVE-2021-29441) are not new. What is new is the orchestration layer: a large language model agent that autonomously chains these techniques without human direction at each step. Future campaigns will use this methodology with different initial access vulnerabilities.

Does patching CVE-2025-3248 protect me from JADEPUFFER?

Patching Langflow removes the specific initial access vector used in this campaign. However, JADEPUFFER represents a class of attack that will adapt. Organisations should treat the Langflow patch as the minimum response and implement the full hardening checklist above — particularly secrets management and runtime monitoring — to be resilient against future agentic attacks using different entry points.

Are Indian organisations specifically targeted?

The JADEPUFFER campaign as documented by Sysdig targeted internet-exposed Langflow instances globally, not India specifically. However, India’s rapid AI adoption means a disproportionate number of vulnerable Langflow deployments may be in Indian cloud environments. The attack technique is indiscriminate — it targets infrastructure exposure, not geography.

Can traditional EDR or SIEM tools detect AI-agent attacks?

Partially. Traditional signature-based detection will miss LLM-generated payloads that vary on every execution. However, behavioural detection is effective: unusual cron job creation, unexpected outbound connections from application processes, and database encryption patterns are all detectable. The LLM’s habit of leaving plain-English code comments also creates a readable signal in logs that human-written exploits typically do not.

---

JADEPUFFER is a turning point, not an outlier. Autonomous AI agents have now crossed from research curiosity to operational threat actor capability. Organisations that treat AI security as a future problem are already behind.

If you are running AI workloads — Langflow, custom LLM agents, or any LLM-adjacent infrastructure — and you want an expert assessment of your exposure, contact Sanjay Seth for a zero-trust security review tailored to your environment. With three decades of hands-on experience in network security, FortiGate deployments, and SOC operations across India, we can help you map your AI attack surface and close the gaps before an autonomous agent finds them first.