The First AI-Run Ransomware Attack Used Zero Zero-Days
Security researchers at Sysdig have documented what they believe is the first ransomware intrusion run from start to finish by an autonomous AI agent. The operation, which they named JADEPUFFER, handled its own reconnaissance, credential theft, lateral movement, persistence and encryption without a human steering each step. The detail that should interest anyone responsible for a software inventory is not the AI. It is that the agent never needed a novel exploit. Every door it opened had been documented, publicly, for between one and six years.
The three doors it walked through
Sysdig's reconstruction identifies three distinct footholds. None was novel; two are not even vulnerabilities in the usual sense.
| Foothold | What it was | Public since | Failure type |
|---|---|---|---|
| Langflow | CVE-2025-3248 — missing authentication on a code-validation endpoint, allowing unauthenticated remote code execution (CVSS 9.8). Fixed in Langflow 1.3.0. | April 2025; added to CISA's KEV catalog in May 2025 | Version currency — a supported fix existed and was not applied |
| MinIO object store | Reachable with the installation-default credentials minioadmin:minioadmin. |
Shipped as the documented default | Insecure default — no patch would have helped |
| Nacos config server | Administrative access obtained using a default JWT signing key. Sysdig also cites CVE-2021-29441, a 2021 authentication bypass. | Signing key publicly documented since 2020 | Insecure default — see the caveat below |
What the agent actually did
The behaviour Sysdig logged is worth reading closely, because it is the part that does not have a precedent. Payloads arrived as Base64-encoded Python through the Langflow execution endpoint. Persistence was a crontab entry beaconing to attacker infrastructure every 30 minutes — unremarkable tradecraft. Then, on the configuration server:
- 19:34:36 UTC — the agent's login attempt fails.
- 19:35:07 UTC — it issues a corrected payload. Thirty-one seconds have passed.
- 19:35:18 UTC — the login succeeds.
The entire backdoor-administrator sequence, including that self-correction, took 54 seconds. It then encrypted 1,342 configuration items using MySQL's AES_ENCRYPT() and deleted the originals.
There is an almost comic postscript. The encryption key was generated on the host, printed to standard output, and never saved or transmitted anywhere the attacker could reach it. The victim's data was unrecoverable — but so was the attacker's ability to sell its return. An agent optimising for execution speed does not automatically build a functioning extortion business.
Only one of the three doors is a lifecycle problem — and we should say so
We track end-of-life dates for a living, so the temptation here is to claim this incident as proof that lifecycle tracking would have stopped it. It would not have, and pretending otherwise is the kind of overclaim that makes security vendors hard to trust.
Here is the honest split. The Langflow foothold is squarely a lifecycle-hygiene failure: the fix shipped in version 1.3.0 on 31 March 2025, CISA catalogued the flaw as actively exploited on 5 May 2025, and the front door was still open when JADEPUFFER arrived more than a year later. That is precisely the class of gap a current inventory closes. The MinIO and Nacos footholds are not: they are insecure defaults that persist in fully supported, fully patched versions. No end-of-life database catches those, ours included.
The useful conclusion is not that one discipline solves it. It is that automated attackers do not respect the boundaries between your disciplines. The agent chained a stale version to a default password to a default signing key without caring which team owned which.
Why this changes the arithmetic of “we’ll upgrade next quarter”
The defence that has quietly protected most out-of-date systems was never technical. It was economic: exploiting a years-old flaw on a low-value host required a human's attention, and that attention was worth more elsewhere. Obscurity was a real, if undignified, control.
Agentic tooling erodes exactly that. When retrying, diagnosing and correcting a failed exploit costs about thirty seconds of unattended compute, the marginal cost of trying an old exploit against an unimportant host falls close to zero. Every internet-facing system running a version whose fix shipped a year ago becomes worth a try — not because the attacker judged it valuable, but because judging is no longer expensive.
The Langflow flaw shows what that looks like in practice. CISA added it to the KEV catalog on 5 May 2025 — a list reserved for flaws with confirmed exploitation in the wild — and in the days around that listing Censys counted roughly 470 internet-facing Langflow instances still reachable. Modest numbers, retried indefinitely, by something that never gets bored.
What to do about it this week
- Find the versions with fixes you have not applied. Not the end-of-life ones — the ones where a patch has existed for months. Paste your stack into the Stack Scanner to see lifecycle status and risk scores in one pass.
- Audit installation defaults on anything internet-adjacent — object stores, config servers, admin consoles, message brokers. Default credentials and default signing keys are invisible to version-based tooling by design.
- Give KEV entries their own track. CVE-2025-3248 was catalogued as exploited-in-the-wild in May 2025. Organisations that treat KEV membership as a hard deadline rather than an input to a backlog closed this door a year before JADEPUFFER came looking.
- Assume no system is too dull to attack. The security-through-obscurity budget has been cut.
Frequently Asked Questions
What is JADEPUFFER?
JADEPUFFER is the name Sysdig gave to what it describes as the first documented ransomware operation carried out end to end by an autonomous large language model agent. The agent handled reconnaissance, credential theft, lateral movement, persistence, privilege escalation and data encryption without a human operator driving each step.
Did the attack use a zero-day vulnerability?
No. Every weakness it used was public and documented. Initial access came through CVE-2025-3248, a Langflow flaw fixed in version 1.3.0 and added to CISA's Known Exploited Vulnerabilities catalog in May 2025. A storage service was reachable with its installation-default credentials. The configuration server was entered using a default signing key that has been publicly documented since 2020.
Was the victim running end-of-life software?
Not exactly, and the distinction matters. The Langflow flaw is a version-currency failure: the fix shipped on 31 March 2025 and had still not been applied more than a year later. The other two footholds were insecure defaults that ship in current, supported versions. Keeping software current would have closed the front door, but not the other two.
Does paying the ransom recover the data?
In this case it could not. Sysdig found the encryption key was generated on the host, printed to standard output, and never persisted or transmitted anywhere the attacker could retrieve it. The 1,342 encrypted configuration items were unrecoverable regardless of payment — a reminder that an autonomous agent optimising for speed does not necessarily build a working extortion business.
What does agentic attack tooling change about patching priorities?
It changes the economics of old vulnerabilities. Exploiting a years-old flaw on an obscure host used to require human attention that was better spent elsewhere. When an agent can retry, diagnose and correct its own failures in around 30 seconds, the cost of attempting an old exploit approaches zero — so the assumption that low-value or overlooked systems are protected by attacker disinterest no longer holds.
Sources
- Sysdig — JADEPUFFER: agentic ransomware for automated database extortion (primary research)
- BleepingComputer — JadePuffer ransomware used AI agent to automate entire attack
- Dark Reading — the first complete LLM-driven ransomware attack
- The Hacker News — AI agent exploits Langflow RCE to automate database ransomware attack
- Horizon3.ai — CVE-2025-3248 Langflow unauthenticated RCE analysis
- NVD — CVE-2025-3248 (CVSS 9.8, affects Langflow < 1.3.0)
- Help Net Security — KEV addition and Censys exposure count, May 2025