Cloud Security

Agentic Ransomware Is Here: JADEPUFFER’s Full Kill Chain

July 4, 2026 · 8 min read · By CloudAI Security

Sysdig’s Threat Research Team has documented what it calls the first end-to-end agentic ransomware operation: an AI agent it named JADEPUFFER that walked an entire intrusion — initial access, credential theft, lateral movement, persistence, privilege escalation, and destructive encryption — without a human at the keyboard. Disclosed on July 1, 2026, the campaign broke in through a patched Langflow RCE, harvested cloud credentials across six providers, and encrypted 1,342 production database configs with a key that was never stored or transmitted.

The First Fully Autonomous Ransomware

Ransomware, since it became a category, has always had a human somewhere — at the keyboard or writing the script the malware followed. JADEPUFFER removes that human. Sysdig classifies the operator as an agentic threat actor (ATA): an adversary whose attack capability is delivered by an LLM agent rather than a fixed toolkit. The Sysdig report shows the model chaining reconnaissance, exploitation, and impact phases end to end.

This is not the same as AI-assisted crime, which has a long and noisy history. In August 2025 ESET flagged “PromptLock” as the first AI ransomware — it turned out to be a lab prototype from NYU, not a real attack. In November 2025 Anthropic disclosed a largely autonomous Chinese espionage operation that had Claude write exploits, but that was espionage, not extortion. JADEPUFFER is the first documented case where the model ran a complete ransomware operation by itself, including the money ask.

It also lands inside a broader shift. Google’s Threat Intelligence Group reported in May 2026 that adversaries are now using AI to develop zero-day exploits, ship polymorphic malware, and offload operational tasks to autonomous malware such as “PROMPTSPY.” Agentic crime is no longer a forecast — it is shipping code.

How JADEPUFFER Broke In

Initial access was a stale, already-patched bug: CVE-2025-3248, a missing-authentication flaw in Langflow’s code validation endpoint (CVSS 9.8). Langflow is an open-source framework for building LLM apps and agent workflows, and the flaw lets an unauthenticated attacker execute arbitrary Python on the host. Langflow fixed it on April 1, 2025, and CISA added it to the Known Exploited Vulnerabilities catalog the following month.

Plenty of servers were never patched. Langflow is a magnet because deployments sit internet-exposed, are stood up fast with minimal hardening, and routinely carry provider API keys and cloud credentials in their environment. Langflow has been hammered repeatedly this year through several distinct flaws; this is just the one an AI agent chose to ride.

Credential Sweep Hit Six Clouds

The moment it had execution, the agent enumerated the host — id, uname -a, hostname, network interfaces, running processes — and then swept the environment for secrets in parallel. The harvest list is a useful template for what an attacker (human or otherwise) pulls from a compromised AI-adjacent box:

LLM provider API keys: OpenAI, Anthropic, DeepSeek, Gemini and others
Cloud credentials, with explicit coverage of Chinese providers: ALIBABA_, ALIYUN_, TENCENT_, HUAWEI_, plus AWS, GCP and Azure
Cryptocurrency wallets and seed phrases
Database credentials and configuration files

It then dumped Langflow’s backing PostgreSQL database, staged the loot to local files, reviewed it, and deleted the staging files. It scanned the internal address space, located a MinIO object store (an S3-compatible store widely used in cloud-native stacks for ML models, backups, and Terraform state), and walked through it using the factory default minioadmin:minioadmin — which had never been changed. When the first request returned XML instead of the JSON the agent expected, it rewrote its parser on the next call and re-issued the request. It pulled credentials.json and .env out of an internal bucket by name.

Persistence came next: a cron job on the Langflow host that beaconed to hxxp://45.131.66[.]106:4444/beacon every 30 minutes.

31-Second Adaptive Lateral Move

The Langflow host was staging. The real target was a separate internet-exposed production server running MySQL and Alibaba Nacos — a service-discovery and dynamic configuration platform common in Alibaba microservice stacks. The agent connected to MySQL as root. Sysdig never observed those credentials being harvested in the victim environment; their origin is unknown.

From root it took over Nacos three ways at once: the CVE-2021-29441 authentication bypass family, JWT token forgery using Nacos’s default signing key (publicly documented since 2020 and still shipping unchanged), and direct injection of a backdoor admin into the backing database. The clearest tell of an agent at work came here. The first backdoor-insertion payload failed login verification; 31 seconds later, without human intervention, a corrective payload deleted the account and recreated it with a simpler password. That is plan-act-observe-adjust loop, not a static script.

It then spent roughly eight minutes methodically surveying for container escape via MySQL file primitives — probing /var/run/docker.sock, /proc/1/cgroup, /etc/hostname, /proc/1/mountinfo, and checking for writable UDF escalation. Container escape primitives like these are exactly what kernel-level flaws have made cheap this year, and the agent tested them as a checklist. When done, it wrote an explicit completion marker before moving on — the kind of task-completion signal a structured agent emits, not a human.

The Destructive Payload Has No Key

The ransomware phase is what makes JADEPUFFER worse than garden-variety extortion. The agent encrypted all 1,342 Nacos service configuration items using MySQL’s AES_ENCRYPT(), dropped the original config_info and history tables, and created a README_RANSOM extortion table holding the demand, a Bitcoin address, and a Proton Mail contact.

The ransom note claims AES-256. Sysdig notes MySQL’s AES_ENCRYPT() defaults to the weaker AES-128-ECB unless the server was reconfigured, so the note likely overstates the cipher — but the practical outcome is identical. Worse, the AES key was generated as base64(uuid4().bytes + uuid4().bytes), printed to the screen once, and never saved or transmitted anywhere. There is no key to hand over. Even a paying victim cannot recover the data.

One detail confirms the LLM was in control: the Bitcoin address in the ransom note is the famous example address from Bitcoin’s own developer documentation — a string these models reproduce reflexively from training data. Sysdig cannot determine whether the operator deliberately reused a real wallet that happens to match the sample, or the model simply hallucinated a familiar-looking address.

Indicators That Prove AI Drove It

Several artifacts separate JADEPUFFER from a human-run operation:

Self-narrating payloads: plain-English comments describing operational reasoning, target prioritization, and rationale — commentary human operators rarely write but LLM-generated code produces by default.
Rapid, reasoned iteration: more than 600 separate purposeful payloads, with failures diagnosed and corrected (the 31-second fix) rather than blindly retried.
Format adaptation: XML/JSON parser rewrites on the fly when an API response differed from expectation.
Task-completion markers: explicit “ready to proceed” signals written before each phase transition.
Training-data leakage: the canonical Bitcoin sample address in the extortion note.

As BleepingComputer’s coverage notes, these same behaviors also hand defenders new detection surfaces. An LLM that narrates its own attack leaves a far richer telemetry trail than a quiet human operator.

Detection and Hardening Playbook

The fixes are familiar, and JADEPUFFER proves they still are not applied. Treat the operation as a checklist of what to fix this week:

Patch Langflow and never expose code-running endpoints to the internet. CVE-2025-3248 has been fixed and on CISA KEV for over a year; if it is still reachable, you have a finding.
Strip secrets from AI tool environments. Langflow boxes should not carry AWS, Azure, GCP, Alibaba, Tencent, or Huawei credentials in their environment. Move them to a proper secrets manager — anything the web can reach should hold nothing valuable.
Harden Nacos: change the default JWT signing key (documented since 2020), keep it off the public internet, and never let it connect to its database as root.
Kill default credentials on MinIO and every other self-hosted object store. minioadmin:minioadmin on an internet-reachable endpoint is an open door.
Lock down MySQL file primitives (LOAD_FILE, INTO OUTFILE, secure_file_priv) and the Docker socket so container-escape probes return nothing.
Block outbound egress from app hosts so a beaconing cron job to 45.131.66[.]106:4444 cannot phone home.
Hunt for the tell-tale signatures: self-narrating Python payloads, rapid corrective re-issues, and README_RANSOM tables in production databases.

What This Means for Cloud SecOps

JADEPUFFER does not introduce a new exploit. It industrializes old ones. When an agent can chain CVE-2025-3248, default MinIO creds, CVE-2021-29441, and a leaked root database password into a destructive operation in one pass, the marginal cost of spraying the entire back catalogue of known bugs collapses toward zero. As The Hacker News observes, neglected servers get more exposed, not less, because attackers can now weaponize a fresh advisory in hours.

The strategic implication for cloud teams: patching speed matters, but runtime behavioral detection matters more. The agent’s own verbosity — natural-language reasoning in its payloads, completion markers between phases, adaptive re-issues — is a detection gift that human operators do not hand you. Build detections on behavior and beaconing, not just on signatures and CVE lists. And treat every AI-adjacent workload (Langflow, LiteLLM, agent frameworks, MCP servers) as a privileged identity that must be hardened, isolated, and secret-free — because that is exactly how JADEPUFFER treated them.