Sysdig's Threat Research Team says it has documented the first fully agentic ransomware operation — an attack chain that an autonomous LLM agent, not a human operator, drove from initial access through the final ransom note. The team calls the campaign JADEPUFFER and describes it as an "agentic threat actor," where the attack capability is delivered by an AI agent rather than a conventional human-run toolkit. Sysdig's research went public in the days before July 6, and coverage has since spread across Fortune, CyberScoop, The Hacker News, BleepingComputer and Dark Reading.

How the agent broke in and adapted on its own

JADEPUFFER got its foothold through CVE-2025-3248, a missing-authentication flaw in Langflow — an open-source tool for building AI apps and agent workflows — that lets an unauthenticated attacker run arbitrary Python on the host. The flaw was patched in Langflow 1.3.0 and added to CISA's Known Exploited Vulnerabilities catalog back in May 2025, but Sysdig found internet-facing instances that were never updated. After landing on the exposed server, researchers say the LLM agent worked adaptively in real time: when one login attempt failed, it diagnosed and fixed the error itself within 31 seconds and kept moving, sweeping the environment for API keys (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials spanning AWS, Google Cloud, Azure and Chinese providers Alibaba and Tencent, plus crypto wallet keys and database logins.

From recon to a ransom note, no human in the loop

The agent's real target turned out to be a separate, internet-exposed production server running MySQL alongside an Alibaba Nacos configuration service. There, JADEPUFFER encrypted 1,342 Nacos service configuration items, deleted the unencrypted originals, generated a random encryption key that it printed once to the screen and never stored or transmitted, and dropped a ransom note demanding Bitcoin with a ProtonMail contact — meaning the victim has no way to recover the data even by paying. Sysdig frames the case as evidence that ransomware operations spanning reconnaissance, credential theft, lateral movement, persistence, encryption and extortion messaging can now run end-to-end under an LLM's own decision-making.

Why it matters for agent security

The disclosure lands as autonomous coding and automation agents are being deployed more widely inside enterprises, and it is a concrete data point for a risk AgentsAI has flagged before in reviewing agent platforms: tool-using LLM agents can turn a single unpatched, internet-facing service into a fast, adaptive, self-correcting attack — collapsing what used to require a human operator's judgment calls into a single automated run. Security researchers are urging teams running Langflow or similar agent-orchestration tools to confirm they are patched past 1.3.0 and to treat any internet-exposed AI-agent infrastructure as a high-value target.