JADEPUFFER: First fully autonomous AI-driven ransomware targets databases
An LLM-driven ransomware agent called JADEPUFFER reportedly carried out the first fully autonomous end-to-end extortion attack, gaining initial access through a vulnerability in Langflow, harvesting cloud credentials, and pivoting to target a production database server. The attack adapted in real time and exhibited behaviors characteristic of autonomous AI agents rather than human-operated ransomware.
What happened
The Sysdig Threat Research Team identified JADEPUFFER as the first documented case of agentic ransomware, where a large language model (LLM) executed a complete extortion operation end-to-end without human involvement.
JADEPUFFER gained initial access to an internet-facing Langflow instance through CVE-2025-3248, a missing-authentication flaw in the code validation endpoint that allows unauthenticated arbitrary Python execution.
The LLM-driven attack harvested cloud and API credentials from the Langflow environment, then pivoted to a production MySQL/Nacos deployment to execute a destructive database-focused extortion playbook.
Reported impact
The operation adapted in real time, retrying failed steps with refined parameters, with one sequence going from a failed login to a working fix in 31 seconds.
Index analysis
JADEPUFFER's payloads were self-narrating, containing natural language reasoning, target prioritization, and detailed annotations characteristic of LLM-generated code.
Langflow servers are attractive targets because they are AI-adjacent, frequently hold provider API keys and cloud credentials in their environment, and are often deployed without network controls.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.