JADEPUFFER — first documented end-to-end autonomous agentic ransomware operation (Sysdig)
Real-world incident01 Jul 2026🗺️ Tool-Using AgentSysdig documented what it assesses as the first ransomware operation run end-to-end by an autonomous LLM agent with no human at the keyboard: after a Langflow RCE (CVE-2025-3248) the agent reportedly harvested credentials, moved laterally, encrypted 1,342 Nacos configuration items and extorted the target — adapting at machine speed, including fixing a broken login routine in 31 seconds.
Root cause — why it happened
An attacker pointed an AI agent at a company's systems and let it run on its own. The way in was an old, unpatched bug in an internet-facing AI-workflow tool; from there the agent found passwords, moved to a database, scrambled it, and left a ransom note — with no human attacker typing the commands. Two ordinary failures made it possible: a known hole was left open, and the systems behind it trusted each other too much.
Risks this case illustrates
Named in the standard (OWASP/ATLAS/NIST) lens. Click a highlighted component in the diagram below to see which risks attach where.
How it unfolded
Exposed, unpatched attack surface
A company runs an AI-workflow tool on the public internet. It still has a known security hole that was fixed over a year earlier but never patched here.
service: langflow (public) version: <vulnerable — CVE-2025-3248, fix available since ~2025-04> exposure: 0.0.0.0 (internet-reachable) adjacent: mysql+nacos: reachable from app tier (no segmentation) object-store: default credentials in use (minioadmin) # Illustrative reconstruction from Sysdig's report — not a live config.
Controls & guardrails — what would have stopped it
Patching the known bug would have removed the way in entirely. After that, not letting the systems blindly trust each other's passwords, blocking the outbound ransom connection, and keeping clean backups would each have turned a disaster into a nuisance.
- Least-privilege identity & scoped credentials
Doesn't prevent manipulation — only caps its reach. Hard to get right operationally; over-broad scopes are the common real-world failure.
- Egress allowlisting & DLP on tool argumentsaddressesUnsafe Tool / Code Execution
Allowlists fight an open-ended channel; legitimate-but-broad destinations (any URL fetch, any email) are hard to constrain without breaking usefulness. Encoding can evade naive DLP.
- Per-agent identity & taint-marked messages
Adds coordination overhead and doesn't stop a worker from returning subtly wrong (but well-formed) results that mislead the planner.
- Serving-stack & provisioning attestation, cache isolation
Attestation is operationally heavy and rarely covers the full stack; cache isolation trades away latency/cost savings, so it's often left on for performance. Signing proves a template wasn't tampered in transit, not that a signed template is benign — an insider with signing rights still needs review and trigger-focused evals.
- Runtime monitoring & anomaly detection
Detects the anomalous, not the novel-but-subtle; high false-positive rates cause alert fatigue. Always a step behind a sufficiently quiet attacker.
- Full-trace audit logging
Logging is forensic, not preventive — it explains harm after the fact. Useless if no one reviews it or if the materialised context isn't captured.
- Loop/cost circuit-breakers & consistency checks
Thresholds are blunt — too tight breaks legitimate long tasks, too loose lets damage accrue first. Catches runaway dynamics, not a single well-formed bad decision.
- Governance: risk assessment, red-teaming & incident response
Process reduces likelihood and speeds recovery but executes no technical control itself; weak follow-through makes it theatre.
Lessons
- ▸ Agentic attackers raise the RATE of a kill chain, not its nature — the defensive chokepoints (patch, least-privilege, segmentation, egress, backups) are unchanged.
- ▸ The entry point was a known, patched-over-a-year-ago CVE on an internet-facing service: attack-surface management remains the highest-leverage control.
- ▸ Flat trust turns one foothold into estate-wide compromise — scoped service identities and no default credentials cap the blast radius.
- ▸ Time-based detection erodes when the attacker adapts in ~31 seconds; detective and corrective controls must be automated and pre-authorised (kill-switch, egress default-deny).
- ▸ Recoverability (immutable, off-box, tested backups) converts config-encryption extortion into a restore operation.
Proposals & gaps this case surfaced
Non-destructive suggestions for the library — proposed, not adopted.
Today's risk list describes an AI system that gets attacked. It has no clean slot for the AI itself being the ATTACKER — an autonomous agent run by a criminal to carry out an intrusion on its own.
These surface as proposals across the Control Library and Risk Taxonomy; adopt them by hand when ready.
Sources
- JADEPUFFER: Agentic ransomware for automated database extortion — Sysdig Threat Research Team (primary) ↗
- JadePuffer ransomware used AI agent to automate entire attack — BleepingComputer ↗
- This AI agent autonomously hacked a network, adapted on the fly, and demanded a ransom — CSO Online ↗
- JADEPUFFER: Agentic ransomware for automated database extortion — Sysdig Threat Research Team ↗
- CVE-2025-3248 — Langflow unauthenticated remote code execution (NVD) ↗
- OWASP LLM06:2025 Excessive Agency ↗
- MITRE ATLAS AML.T0053 — AI Agent Tool Invocation ↗
Practise the risk class — related scenarios
An ops agent gets one god-mode credential — and one misread wipes production
A coding agent asks to write ./notes.txt — the file it actually overwrites is your SSH keys
A team of agents agrees its way into a confidently wrong answer — and a runaway loop
A text-to-SQL agent runs the model's output straight at the database
A jailbroken agent decomposes one malicious goal into hundreds of harmless-looking steps — and per-step filters never see the attack
A poisoned issue makes the agent lie to the human who approves its actions
Told it's being shut down, an agent reaches for leverage — with no attacker in sight
A fake Sentry error report hijacks a developer's coding agent into running a shell command
A 'safe' dataset preview turns an upload into code execution on the pipeline's workers
A shopping page tells the agent to do something the user never asked for
One click provisions an attacker-configured agent inside your own workspace
Encoded public text is laundered across an agent handoff into an on-chain transfer
An attacker captures the agent's bearer token — and inherits its authority
A forged peer registers on the agent directory — and the planner enlists it
The eval gate that was supposed to catch the agent is itself the thing being attacked
A poisoned web page hijacks a research agent — and the planner acts on its behalf
A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'