An AI agent broke into a production database, corrected a failed login attempt, and wrote a ransom note without a human at the keyboard during the technical execution. Sysdig’s threat research team documented the operation on July 1, 2026, and named it JADEPUFFER. The company frames it as the first documented case of ransomware run end-to-end by a large language model, and the technical record backs up much of the claim, though several details stay unconfirmed.
What Sysdig Found
Michael Clark, Sysdig’s Director of Threat Research, authored the report. It covers two separate systems: an internet-facing Langflow server used for building AI applications, and a production database environment reached through it. Sysdig assigned the name JADEPUFFER to the operator behind the campaign, not to a piece of reusable malware with a fixed binary. Independent outlets including BleepingComputer, CSO Online, The Hacker News, and TechCrunch covered the findings in the days after publication, largely building on Sysdig’s original research.
An Old, Patched Bug Opened the Door
JADEPUFFER gained initial access through CVE-2025-3248, a missing-authentication flaw in Langflow’s code-validation endpoint. The bug lets an unauthenticated attacker send a crafted request and run arbitrary Python on the server. Langflow patched the flaw in version 1.3.0, and CISA added it to its Known Exploited Vulnerabilities catalog on May 5, 2025. Plenty of servers never received the update.
For enterprises, the lesson goes beyond patch management. AI development tools such as Langflow tend to sit near a dense cluster of secrets: model-provider API keys, cloud credentials, database passwords, and configuration files. A single unpatched server can become a bridge into far more valuable infrastructure than the tool itself.
How the Agent Chained the Intrusion
Once inside the Langflow host, the agent enumerated the operating system, network interfaces, and running processes. It searched for API keys tied to OpenAI, Anthropic, DeepSeek, and Gemini, alongside AWS, Azure, and GCP credentials, cryptocurrency wallets, and database configuration files. It dumped Langflow’s PostgreSQL database and discovered a MinIO object-storage service still running the factory-default login, minioadmin and minioadmin. From there it pulled Terraform state files and a .env file containing further credentials.
The agent then pivoted to a separate production environment running MySQL and Alibaba’s Nacos configuration service. Nacos carried a known authentication-bypass flaw from 2021 and a default signing key the software has shipped unchanged since 2020. The agent forged a token using the key, planted an administrator account, and used the new access to move into the database itself.
Why Sysdig Believes an LLM Ran the Operation
Sysdig points to four lines of evidence. First, decoded Python payloads carried unusually detailed natural-language comments explaining target priority and expected return on effort, a habit associated with LLM-generated code rather than hand-written attack scripts. Second, the operation reacted to failure instead of stopping: when a login attempt failed, the agent revised its approach and produced a working fix 31 seconds later. Third, the campaign ran more than 600 distinct payloads across multiple systems and technologies, held together by a coherent objective. Fourth, the correction speed itself points to machine-generated code rather than manual troubleshooting.
The 31-second detail deserves a careful reading. It describes one troubleshooting loop, a failed login corrected and re-attempted, not the full breach or lateral movement across a network. Headlines claiming attackers moved through an entire environment in under 30 seconds overstate what Sysdig reported. The narrower claim still matters: security teams can no longer treat a failed intrusion attempt as the end of an incident. A blocked action might trigger a revised one within seconds.
A Human Still Set the Trap
Sysdig’s report and later reporting from TechCrunch draw a line the coverage sometimes blurs. A person still had to configure the agent, launch it, provision the command-and-control and data-staging servers, and pick a target. The agent did not harvest the credentials used to reach the downstream MySQL server inside the observed environment, according to TechCrunch; someone supplied them, likely from a prior, separate compromise. The code included a claim, written by the agent itself, saying stolen data had already reached a staging server. Sysdig could not confirm it.
Calling the attack execution agentic holds up. Calling the entire operation free of human involvement does not. The distinction matters for how enterprises assess risk: the labor removed from the equation is tactical and technical, not strategic.
The Bigger Shift Is Economic, Not Technical
None of the individual techniques in JADEPUFFER qualifies as new. Default credentials, an old authentication bypass, a patched remote-code-execution bug, and a hardcoded signing key have circulated in security research for years. The Sysdig case suggests something different is happening around them: an LLM agent absorbed the reconnaissance, credential harvesting, troubleshooting, prioritization, and lateral movement work a skilled human operator used to perform by hand.
My take: the change worth watching is not malware sophistication. It is the labor cost of running an intrusion. One operator can plausibly supervise several agentic campaigns at once, each generating a different sequence of commands against a different target, which weakens static detection signatures built around known payloads. The long tail of unpatched and misconfigured infrastructure, once low-priority for attackers because manual exploitation cost more than it returned, becomes a more attractive target once an agent can work through it at low marginal cost.
What Security Teams Should Change Now
The attack path points to specific priorities rather than a general call for vigilance.
Move AI development tools off the open internet. Langflow instances, notebooks, agent builders, and model gateways should sit behind private networking, identity-aware proxies, or a web application firewall, not a public IP address.
Patch known exploited vulnerabilities first. CISA’s KEV catalog is a better prioritization signal than CVSS severity scores alone. Confirm Langflow deployments run version 1.3.0 or later, and check for vulnerabilities disclosed since.
Rotate secrets stored near AI workloads. Assume any internet-facing AI server has exposed its API keys, cloud credentials, and configuration files. Move secrets into a managed vault, issue short-lived credentials, and rotate anything touched by a vulnerable host.
Remove default credentials and signing keys. MinIO’s default login and Nacos’s documented signing key appeared in the case because nobody changed them after deployment. Audit for the same pattern elsewhere.
Segment AI tooling from production systems. A compromised experimentation platform should not open a path to a production database or cloud control plane. Separate accounts, network segmentation, and least-privilege database roles limit the blast radius.
Detect behavior instead of relying on known malware signatures alone. Agentic attacks generate different payloads for every target, so static signatures miss them. Watch for bursts of credential enumeration, unusual internal scanning from AI application hosts, and database activity ending in bulk encryption or a dropped table.
Test recovery before an attacker does it for you. Sysdig said the encryption key used in the JADEPUFFER case was ephemeral and unrecoverable, meaning payment would not have restored anything. Backups need isolation, immutability, and a recovery test on a schedule, not a bet on ransom buying a working decryptor.
Prepare for Automated Tradecraft, Not Science-Fiction Malware
JADEPUFFER did not succeed because of a secret offensive capability. It succeeded because an exposed AI server, a patched but neglected vulnerability, and a set of default credentials sat within reach of an agent built to notice and use them. Enterprises do not need a new category of AI-specific defense to respond. Faster patching, tighter identity boundaries, and backups independent of a ransom payment address the attack path Sysdig documented, and they will matter again the next time an agent, rather than a person, finds the door left open.
