Something crossed a threshold this week. Sysdig's Threat Research Team documented what they're calling the first end-to-end ransomware campaign driven entirely by a large language model — no human operator in the loop after initial deployment. They named the threat actor JADEPUFFER, and they introduced a new classification for this kind of attacker: an agentic threat actor, or ATA. If that framing sounds like analyst terminology you can safely ignore, stay with me for a few minutes, because this one is different in ways that matter to everyone running real systems.
What Actually Happened
The attack began with CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, the open-source framework for building AI workflows that's become common across engineering teams over the last year. The vulnerability was patched on April 1, 2025. The targeted organization hadn't applied it — which means they had a 15-month-old unpatched RCE on an internet-facing system that holds credentials. That's the setup. Here's what the agent did with it.
The autonomous LLM agent executed the following kill chain without a human making a single tactical decision:
- Gained initial access via the Langflow RCE endpoint, delivering Base64-encoded Python payloads
- Harvested credentials stored on the Langflow host — API keys, cloud service accounts, configuration tokens
- Moved laterally to a production server running MySQL and Alibaba Nacos, a popular service configuration and discovery platform
- Mapped internal services and established persistence
- Escalated privileges by exploiting a well-documented 2021 Nacos authentication bypass
- Encrypted 1,342 Nacos configuration records using AES encryption
- Deleted the original tables
- Left a Bitcoin ransom demand in place of the data
The total payload count across the campaign: over 600 coordinated payloads, all generated and executed without a human making a single tactical call. HIPAA Journal's writeup and CSO Online's coverage both draw on the Sysdig TRT report directly.
The 31-Second Recovery That Changes Everything
The speed of adaptation is the detail I can't get past. In one documented sequence, the agent attempted to create an administrator account in Nacos, failed, diagnosed the failure, generated a corrected payload, and succeeded — all in 31 seconds. That's not a script running through a fixed decision tree. A script would fail and halt. This system observed the error, reasoned about the cause, and retried with a working payload.
Sysdig documented a second adaptation pattern that's equally striking: when an API returned XML instead of the expected JSON, the agent's subsequent payloads automatically modified their parsing logic to handle the format change. It wasn't following a playbook. It was reading the environment and adjusting.
The Sysdig TRT also flagged something they called self-narrating code. JADEPUFFER's generated payloads included natural language annotations explaining the agent's own reasoning — target prioritization, why it chose a particular technique, what it expected each step to produce. The LLM was, in their words, "narrating its own intent the entire way." That's forensically useful — defenders who intercept the traffic can read the attacker's next moves — but it's also a sign of how coherent and purposeful the execution chain was. This wasn't noise. It was directed problem-solving.
Why Langflow Was the Right Door
The choice of Langflow as the entry point isn't accidental, and it matters for anyone building AI infrastructure. Langflow instances carry a cluster of properties that make them valuable beyond the vulnerability itself:
- They're frequently deployed without network controls because teams treat them as internal dev tooling
- They almost always hold high-value credentials: LLM provider API keys, vector database access tokens, cloud service accounts
- They're stood up quickly during proof-of-concept phases and quietly forgotten when the PoC becomes production
- Their association with AI pipelines puts them adjacent to sensitive systems and data flows
I've watched this exact pattern play out over decades with other infrastructure categories. Something gets classified as a "dev tool" or "workflow utility" and its patch cadence drops to zero while it accumulates access to everything that matters. Langflow running unpatched through mid-2026 with a 15-month-old RCE isn't an edge case — it's a description of how most fast-moving engineering teams operate. The urgency here isn't hypothetical.
The AES Key Problem
One technical detail deserves specific attention: the AES encryption key used to lock those 1,342 Nacos configuration records was not transmitted to attacker infrastructure. That means payment of the ransom would have recovered nothing. Your configuration data — or whatever the equivalent is in your environment — would remain encrypted with a key the attacker may not even possess.
Whether this was a deliberate design choice (pure destruction disguised as extortion) or a bug in the agent's operational logic is unknown. But the operational implication is significant. When there's no functional key exchange mechanism, you're not dealing with a negotiation — you're dealing with a destruction event. Incident response posture should reflect that from the first moment of detection. Don't waste time in ransom discussions. Get to recovery immediately.
Three Things That Actually Change
I want to be precise here rather than alarmist. JADEPUFFER targeted an organization with a 15-month-old unpatched RCE on an internet-facing system. Basic hygiene would have blocked this specific attack. But the capability demonstrated is real, and it shifts some assumptions I've previously relied on.
The skill floor for sophisticated attacks has dropped to near zero. Sysdig put it directly: "The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero." A skilled human attacker who understands Langflow internals, Nacos authentication, and MySQL encryption in combination is rare and expensive. An LLM agent carries that knowledge without the operator needing any of it. The population of people capable of mounting adaptive, multi-stage intrusions just expanded dramatically.
Signature-based detection is now a liability if treated as sufficient. JADEPUFFER generated over 600 novel payloads adapted to runtime conditions. No signature database covers that. What you can detect is the behavioral chain: unusual authentication attempts, credential access followed by lateral movement, abnormal database operations, privilege escalation patterns. If your security stack can't observe and correlate that chain in real time, you're blind to this class of attack regardless of how current your signatures are.
Patch windows on AI tooling need to match production systems. The old mental model allowed for extended lag on "lower severity" tools or internal-facing systems. An agent that chains a dated RCE through a forgotten credential store to a production database in a single automated campaign invalidates that model. Every internet-adjacent system that touches credentials or production data is a potential pivot point.
What I'm Doing in My Own Environment
A few concrete reviews I'm running after reading this report:
- Audit AI tooling for network exposure. Langflow, Flowise, Dify, n8n — any workflow builder that might hold LLM API credentials should be behind authentication, behind a VPN, or both. These tools are almost never hardened during initial deployment.
- Rotate credentials stored in AI infrastructure. If any of these systems have been running in your environment, treat their credential stores as potentially compromised and rotate accordingly.
- Patch Langflow to 1.3.0 or later immediately if you haven't. CVE-2025-3248 was fixed in that release, April 2025.
- Review Nacos authentication configuration. The 2021 Nacos auth bypass used for lateral movement in this campaign is documented and well-known. If you're running Nacos, check your auth settings today.
- Test your incident response speed. If an attacker can go from initial access to encrypted production database in a single autonomous campaign, the window between detection and containment is measured in minutes, not hours. Run a tabletop focused specifically on automated lateral movement and fast encryption scenarios.
The Part That Stays With Me
What bothers me most about JADEPUFFER isn't the technical sophistication of the attack — it's how low the bar was for deploying it. The operator didn't need deep knowledge of Langflow, Nacos, or MySQL encryption. They didn't need to manually craft 600 adaptive payloads or debug authentication failures in real time. They needed an LLM-driven agent framework and an unpatched target. Everything else the agent figured out.
We've built security programs on the assumption that sophisticated, adaptive attacks require sophisticated, trained attackers. That assumption is no longer reliable. The offense is getting automated. The defense — patching, behavioral monitoring, identity controls, fast incident response — requires exactly the expertise it always has.
None of the right responses here are new. They're the fundamentals applied with more urgency and less tolerance for lag. The cost of skipping them just went up.
The Dark Reading writeup is a good next read if you want the full technical breakdown before your next team standup.