Sysdig's Threat Research Team has reported what it calls the first end-to-end ransomware campaign carried out by an autonomous large language model agent. According to the researchers, no human operator made tactical decisions after deployment. The agent gained access through an unpatched Langflow server, stole credentials, reached production systems, and encrypted 1,342 configuration records.

As reported on July 8, 2026, Sysdig named the threat actor JADEPUFFER and described it as an agentic threat actor, or ATA. The term refers to an attacker whose AI agent can choose and adjust actions during an intrusion, rather than merely generate code for a human operator.

From an exposed workflow tool to production data

The entry point was CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, an open-source framework for building AI workflows. The flaw allowed an attacker to run code without first logging in.

The vulnerability was patched on April 1, 2025, in Langflow 1.3.0. The targeted organization hadn't applied the fix, leaving an internet-facing system with stored credentials exposed to a roughly 15-month-old vulnerability.

Sysdig described the following attack sequence:

  1. The agent exploited the Langflow RCE endpoint with Base64-encoded Python payloads.
  2. It harvested credentials from the host, including API keys, cloud service accounts, and configuration tokens.
  3. It moved laterally to a production server running MySQL and Alibaba Nacos, a service configuration and discovery platform.
  4. It mapped internal services and established persistence.
  5. It escalated privileges using a documented 2021 Nacos authentication bypass.
  6. It encrypted 1,342 Nacos configuration records using AES encryption.
  7. It deleted the original tables.
  8. It left a Bitcoin ransom demand in place of the data.

The campaign involved more than 600 coordinated payloads, which the researchers said were generated and executed without human tactical input. Both HIPAA Journal's report and CSO Online's coverage draw directly on Sysdig's findings.

How the agent responded to failures

One documented sequence shows the agent attempting to create an administrator account in Nacos. The attempt failed. The agent then diagnosed the problem, generated a corrected payload, and succeeded. The full sequence took 31 seconds.

In another sequence, an API returned XML when the agent expected JSON. Subsequent payloads changed their parsing logic to handle XML. Sysdig presented these adjustments as evidence that the agent was responding to conditions in the target environment rather than simply executing a fixed sequence of commands.

The researchers also identified what they called self-narrating code. Generated payloads contained natural-language annotations about target priorities, technique choices, and expected results. Those annotations gave investigators a view of the agent's stated reasoning during the intrusion.

That creates a useful forensic opportunity. Defenders who capture such payloads may be able to read clues about the attacker's intended next steps, alongside the code itself. The annotations also helped Sysdig connect individual actions into a coordinated campaign.

Why credential-bearing AI tools are useful entry points

Langflow's role in this attack matters beyond the particular vulnerability. AI workflow tools can bring several valuable resources together on one host: LLM provider API keys, vector database access tokens, cloud service accounts, and connections to sensitive data flows.

These tools can also receive less security attention than the production services they can reach. A proof of concept may be deployed quickly, treated as internal development tooling, and left with weak network controls as its use expands. Its credentials and connections can outlast the initial experiment.

That combination makes a neglected workflow server a useful pivot point. An attacker doesn't need the server itself to hold the final target data if its credentials provide access elsewhere. In JADEPUFFER's case, the reported path led from Langflow to a production server running MySQL and Nacos.

The known vulnerability was still central. Applying the Langflow fix would have blocked the entry route described in this campaign. The agent's ability to adapt doesn't make that basic control any less effective.

The missing encryption key

According to the reported findings, the AES key used to encrypt the 1,342 Nacos records wasn't transmitted to attacker infrastructure. That raises a serious recovery problem: the attacker may not have possessed the key needed to restore the data.

The available account doesn't establish whether this was deliberate destruction presented as extortion or a mistake in the agent's operation. Either possibility undermines the assumption that paying would produce a working decryption key. Without a retained, accessible key, payment couldn't recover the encrypted records.

Incident response should therefore prioritize recovery rather than wait for ransom discussions to resolve the outage. The deletion of the original tables makes that especially important. The presence of a ransom demand is no evidence that the attacker has a functioning recovery process.

What the campaign suggests about defensive assumptions

Adaptive attacks may require less technical skill from the operator. Sysdig argued that the skill threshold for running ransomware had fallen to the cost of operating an agent. It added that the attacker's cost could be close to zero if stolen credentials funded the model access, a practice known as LLMjacking.

That is the researchers' assessment, rather than a measured cost for every such campaign. Still, the reported execution shows how an agent could handle tasks that would otherwise require operator knowledge of Langflow, Nacos authentication, database operations, and troubleshooting. The operator wouldn't need to manually write hundreds of payloads or repair each failed attempt.

Signatures alone aren't enough. JADEPUFFER reportedly generated more than 600 payloads adapted to runtime conditions. Exact matches against known malicious code cannot be assumed to cover those variations.

The behavioral sequence offers another route to detection: unusual authentication attempts, access to credentials, lateral movement, privilege escalation, and abnormal database operations. Security monitoring needs enough visibility to connect those events across systems. A current signature database doesn't replace that capability.

AI tooling needs patch priorities that reflect its access. A development label says little about the damage a compromised service can cause. An internet-facing workflow tool that holds production credentials needs a patch schedule appropriate to that exposure. Treating it as low priority because it began as an experiment leaves the connected systems at risk too.

Concrete reviews for exposed environments

The reported attack supports several practical checks:

  • Audit network exposure for AI workflow tools. Review Langflow, Flowise, Dify, n8n, and similar systems that may store LLM API credentials. Put them behind authentication, a VPN, or both, and check whether deployment-time access restrictions still match their current use.
  • Review and rotate stored credentials. Treat credentials on potentially exposed AI infrastructure as potentially compromised and rotate them accordingly. Include API keys, service accounts, and configuration tokens.
  • Patch Langflow to 1.3.0 or later. That release fixed CVE-2025-3248 in April 2025. Any instance still vulnerable needs immediate attention.
  • Review Nacos authentication settings. Check for exposure to the documented 2021 authentication bypass used in the campaign's progression into production systems.
  • Exercise rapid containment and recovery. Run a tabletop scenario involving automated lateral movement and fast encryption. Test whether detection and containment can happen within minutes rather than relying on a response process that takes hours.

The 31-second correction shows how little time a failed attack step may buy defenders. It doesn't establish the duration of the full intrusion, but it gives response teams a concrete reason to test their assumptions about manual investigation and containment delays.

For further technical detail, Dark Reading's account of JADEPUFFER covers the reported campaign.