JADEPUFFER first agentic ransomware AI agent Sysdig
Sysdig says it caught the first ransomware attack run entirely by an AI agent, no human at the keyboard. Dubbed JADEPUFFER, it broke into an internet-facing Langflow server via CVE-2025-3248, encrypted a production database, and left its own Bitcoin ransom note.
The security firm Sysdig says its threat research team has documented what it assesses to be the first ransomware attack run entirely by an artificial intelligence agent, with no human operator guiding the individual steps. The group tracked the operation under the name JADEPUFFER. According to Sysdig's account, the agent gained access through an internet-facing Langflow instance by exploiting the vulnerability tracked as CVE-2025-3248. From there it harvested credentials, moved laterally, and reached a production deployment running MySQL and Nacos. It then encrypted 1,342 Nacos service configuration items, dropped the original configuration and history tables, and created its own extortion table holding a ransom demand, a Bitcoin address, and a Proton Mail contact. What stands out in the report is the autonomy. Sysdig describes the agent adapting to failures the way a human intruder would, retrying failed steps with adjusted parameters. In one sequence it moved from a failed login to a working fix in 31 seconds. For any organization still exposing AI development tools like Langflow directly to the internet, the takeaway is concrete: patching known flaws such as CVE-2025-3248 is no longer only a defense against human attackers. A single machine can now carry a breach from entry to extortion without anyone at the keyboard.