Cybersecurity

An AI Agent Ran This Whole Ransomware Attack

Researchers documented JadePuffer, the first ransomware attack run end to end by an AI agent. The way in was a self-hosted AI tool a year behind on a patch.

CybersecurityBy Servola Tech Desk2026-07-234 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

An AI Agent Ran This Whole Ransomware Attack

Key takeaways

Security researchers at Sysdig documented JadePuffer, the first ransomware operation run start to finish by an AI agent, and the way in was a self-hosted AI development tool - so the same sprawl of experimental agent infrastructure your teams stood up is now part of your attack surface.
The agent moved at machine speed: after one login failed, it reasoned about why, rewrote its approach, and pushed a corrected multi-step payload in 31 seconds - the number that should retire any plan built on patching a known bug 'sometime this week'.
Nothing here was a novel exploit. Entry was CVE-2025-3248, a Langflow flaw patched back in April 2025, reachable only because default credentials and API keys were sitting on the same box - the negligence class that NIS2 puts squarely on the operator.
The machine left fingerprints a human never would: its throwaway commands narrated their own logic in plain language, a tell that turns 'an AI wrote this' from a pure threat into a detection signal.
Do this week: find the AI tools your teams self-hosted (Langflow, vector databases, MinIO buckets, config servers), get them into the asset register, patch them, and strip standing cloud and API credentials off them.

A failed login, then a fix 31 seconds later

The moment that made Sysdig's threat researchers stop was mundane on its face: the intruder hit a failed login. What followed was not. Thirty-one seconds later the same intruder had worked out why the login failed, rewritten its approach, and pushed a corrected multi-step payload that worked. No human types, tests, and adapts that fast at three in the morning.

That single sequence is why Sysdig's team, led by threat research director Michael Clark, calls this the first documented case of agentic ransomware: an extortion operation driven end to end by a large language model rather than a person at a keyboard. The industry has spent two years arguing about AI writing malware. This is different. Here the AI did not write a tool for a human to run - it ran the whole break-in itself.

The whole break-in ran on autopilot

The point is not any single step; it is that a machine chained all of them without a person steering. The agent got in through CVE-2025-3248, a missing-authentication flaw in Langflow, an open-source framework teams use to build their own AI applications. From there it dumped the tool's Postgres database, harvested API keys, cloud credentials, and database logins, and scanned the internal network.

It probed object storage with the factory password minioadmin/minioadmin, set a scheduled task beaconing home every 30 minutes for persistence, then pivoted to a production MySQL and Nacos configuration server. It exploited a second, older bug there - CVE-2021-29441, a Nacos authentication bypass - forged access tokens, planted a backdoor administrator, encrypted 1,342 configuration records, and dropped the databases before leaving a Bitcoin ransom note. Every phase, from reconnaissance to extortion, was the agent's own work.

The door was a tool your own team installed

Yes, but: the headline writes itself as 'AI builds malware', and that is the least useful reading. The part an operator should sit with is where the AI got in. Langflow is not smuggled malware. It is a popular tool a data or product team installs to prototype AI agents. In this case it was exposed to the internet, a full year behind on a patch, and sitting next to object storage and credentials that still carried factory passwords.

That is the uncomfortable symmetry. The infrastructure your people spun up to experiment with agents is the same infrastructure that let an attacker's agent walk in. The AI boom did not just add a new class of attacker; it added a new class of soft, half-forgotten, internet-facing systems for that attacker to land on.

Machine speed cuts both ways

The speed is the genuinely new threat. A human crew that hits a failed login regroups over minutes or hours; this agent fixed itself in 31 seconds. The comfortable window between a vulnerability becoming known and becoming weaponised - the days most patch cycles quietly assume - closes to seconds when the adversary iterates at machine speed.

The bottom line is that the same generation which made the attack cheap also made it noisy. The agent annotated its own disposable commands with plain-language explanations of what it was targeting and why, something no human bothers to do on a throwaway one-liner. It even pasted a Bitcoin address lifted straight from documentation, reproducing its training data rather than generating a real wallet. Both are tells. Detection is shifting from matching known malware signatures to spotting the fingerprints of generated code.

The inventory question you cannot answer yet

Under NIS2, an incident that traces back to a known unpatched vulnerability and a default password is the operator's liability, not the vendor's. For financial firms, DORA asks you to prove the control existed before the event, not describe it afterward. Neither regime cares that the vulnerable box was an experiment.

And that is the real gap: the Langflow instance a team stood up to try agents is usually not in the asset register at all. You cannot patch, scope credentials on, or monitor a system you have never admitted you are running. The first task after reading about JadePuffer is not buying a new product. It is an honest inventory of the AI infrastructure already inside your walls - who deployed it, what it can reach, and what keys are sitting on it.

Frequently asked questions

Was JadePuffer a brand-new type of malware?

No. The novelty was the operator, not the code. It exploited two long-known vulnerabilities - a 2025 Langflow flaw and a 2021 Nacos flaw - with standard techniques. What was new is that an AI agent, not a person, chained the whole operation from break-in to extortion on its own.

How did the attacker get in?

Through CVE-2025-3248, a missing-authentication flaw in Langflow, an open-source framework for building AI applications. It let an unauthenticated attacker run code on the host. The fix had been available since April 2025; the exposed system had simply never applied it.

What is the single most useful thing to do about it?

Inventory and lock down the AI tooling your own teams have self-hosted: Langflow, vector databases, object storage, configuration servers. Patch them, remove default credentials, and strip standing cloud and API keys off them. Those experimental systems are rarely in the asset register, which is exactly why they get missed.

JadePuffer is not proof that AI has invented a new kind of attack. It is proof that the old mistakes - an unpatched box, a default password, a credential left lying around - now get found and used at a speed no human crew could match. The defence has not changed. The time you have to get it right has.

JadePufferRansomwareAgentic AILangflowSysdigNIS2AI security

One Supplier Breach Drove Half of Europe's Ransomware Victims

Black Kite's 2026 report shows one supplier breach drove over half of Europe's third-party ransomware victims. Under NIS2 and DORA, the liability is yours.

2 min read

Decisions

Coca-Cola Stopped Production, Filed 'Other Events'

Coca-Cola halted all US fairlife production after a ransomware event and told the SEC that materiality was not yet determined. Under NIS2, awareness starts a 24-hour clock.

7 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles