JADEPUFFER: first documented LLM-driven ransomware operation
What happened
Sysdig captured a ransomware operation run end to end by an LLM agent. It entered through an internet-facing Langflow server, harvested and reused credentials, moved laterally, set up persistence and destroyed a production database, correcting its own failures along the way.
The agent got in through CVE-2025-3248, a missing-login flaw in an internet-facing Langflow server that had been public and patched since 2025. Once running code there, it listed the machine's contents, copied its database and collected API keys for several AI providers along with cloud credentials. It then moved to the victim's production server using an old authentication bypass in the Alibaba Nacos configuration service, created itself an administrator account, encrypted more than 1,300 configuration records with a key it printed once and never saved, deleted the originals and left a ransom note. Because the key was never stored, paying would not have restored the data.
Sysdig identified the attacker as an AI agent from its behaviour: its code narrated its own reasoning, it fired around 600 distinct payloads in a few hours, and when one step failed it wrote a working fix in 31 seconds. Sysdig later reported the same operator returning with purpose-built ransomware aimed at destroying AI model files and training data.
How it happened
AI-run attack: Autonomous intrusion. The attacker's own AI agent carried out the break-in, working through the steps with little human involvement.
Sources do not say whose AI model was involved. The product type was AI agent. Vulnerability IDs: CVE-2025-3248.
Impact
Data was both exposed and destroyed. Data involved: credentials. The impact was confined to one organization and its users or customers.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 1 Jul 2026.