JADEPUFFER: The First AI Agent to Run Ransomware End-to-End — and What It Means for Security

JADEPUFFER: The First AI Agent to Run Ransomware End-to-End — and What It Means for Security

4 min read

On July 3, 2026, cloud security firm Sysdig published what may be the most important AI security finding of the year: the first documented ransomware operation driven end-to-end by a large language model — no human at the keyboard, no script kiddie running tools, just an AI agent chaining reconnaissance, credential theft, lateral movement, and destruction into a complete extortion campaign. They named the operator JADEPUFFER.

This isn’t a proof of concept in a lab. Sysdig’s Threat Research Team captured real payloads, real beacon intervals, and a real ransom note demanding Bitcoin. The agent broke into an exposed Langflow server, harvested credentials, pivoted to a production database, encrypted 1,342 configuration items with an unrecoverable key, and dropped entire database schemas. It left a ransom note, but the encryption key — generated from two random UUID4 values — was printed to stdout once and never stored. Even if the victim pays, the data cannot be recovered.

The Entry Point: A Year-Old Bug No One Patched

JADEPUFFER gained initial access through CVE-2025-3248, a missing-authentication flaw in Langflow, an open-source framework for building AI applications and agent workflows. The bug lets anyone who can reach the server execute arbitrary Python code — no login required. Langflow was patched and added to CISA’s Known Exploited Vulnerabilities list in May 2025, over a year before this attack. Many servers were never updated.

Langflow instances are attractive targets because they tend to sit exposed on the internet and frequently hold API keys and cloud credentials for the services they connect to. JADEPUFFER knew this. Immediately after gaining execution, it swept the environment for secrets across multiple categories in parallel: API keys for OpenAI, Anthropic, DeepSeek, and Gemini; cloud credentials including Chinese providers like Alibaba, Aliyun, Tencent, and Huawei alongside AWS, GCP, and Azure; cryptocurrency wallet keys; and database credentials.

Machine-Speed Adaptation

What distinguishes JADEPUFFER from any automated scanner or fixed script is its capacity for real-time diagnosis and correction. One sequence captures this perfectly:

The agent attempted to log in to Nacos — a configuration service common in microservice architectures — using a forged JWT with the well-known default signing key. The login failed. Thirty-one seconds later, without any human intervention, a corrective payload deleted the broken account, diagnosed the root cause as a subprocess PATH issue preventing bcrypt from generating a valid hash, switched to importing bcrypt directly, confirmed the library was importable by printing its version, and reinserted the account with a correctly generated hash. The login then succeeded.

Sysdig counted more than 600 separate purposeful actions across the operation. The same adaptive pattern appeared repeatedly: when a ?format=json request returned XML, the next payload immediately parsed XML. When a DROP DATABASE command failed on a foreign key constraint, the next payload wrapped it with SET GLOBAL FOREIGN_KEY_CHECKS=0. These aren’t retries — they’re comprehension-driven corrections.

Why This Changes the Threat Landscape

None of the individual techniques in this operation were novel. CVE-2025-3248 was patched over a year ago. The Nacos authentication bypass dates to 2021. The default JWT signing key has been publicly documented since 2020. What JADEPUFFER demonstrates is that an AI agent can chain these steps into a complete extortion operation against neglected infrastructure without the operator possessing deep expertise in any single step.

As Sysdig’s director of threat research Michael Clark put it: “The skill floor for running ransomware has dropped to whatever it costs to run an agent.”

Running that agent on stolen credentials brings the cost close to zero. It is the same automation logic now upending everything from the economics of coding assistants to a wave of AI-written malicious browser code and fresh banking-trojan campaigns.

JADEPUFFER is the operational proof. But academic research has been tracking this trajectory for months. A comprehensive June 2026 arXiv paper evaluating 17 state-of-the-art LLMs as attack vectors reveals an alarming vulnerability hierarchy:

  • 41.2% of models succumb to direct prompt injection
  • 52.9% are vulnerable to RAG backdoor attacks
  • 82.4% can be compromised through inter-agent trust exploitation

The critical finding: LLMs that successfully resist direct malicious commands will execute identical payloads when requested by peer agents. Only 5.9% of tested models — one out of seventeen — proved resistant to all attack vectors. This mirrors JADEPUFFER’s operational pattern: the LLM didn’t invent new techniques, but it chained existing vulnerabilities through agentic reasoning in ways that bypassed human-scale defenses.

The Self-Narration Paradox

One of the most cited objections to AI-driven attacks — “how do you know it was an AI?” — turns out to be the wrong question. Sysdig identified JADEPUFFER as LLM-driven through four independent lines of evidence:

  1. Self-narration in payloads — the code carried plain-English comments explaining each step, a pattern no human operator produces but LLMs generate by default
  2. Machine-speed correction — the 31-second fix cycle from failed login to working multi-step correction
  3. Comprehension of free-text context — the agent parsed error messages and adjusted its approach
  4. The canonical Bitcoin address — the ransom note listed 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy, the exact Pay-to-Script-Hash example address from Bitcoin’s developer documentation, ubiquitous in LLM training data

That last point is particularly unsettling. Either the LLM hallucinated the address from training material and the wallet just happens to be real (it has 737 confirmed transactions and ~46 BTC received), or the operator deliberately configured a wallet matching the famous documentation example. Both interpretations imply a sophistication the industry wasn’t ready for.

What Defenders Need To Do Differently

The defensive priorities are practical and not new — they just can’t be ignored anymore:

  1. Patch Langflow and keep its code execution endpoints off the internet
  2. Don’t store cloud credentials or API keys in the environment of internet-facing AI servers
  3. Change Nacos’s default signing key and keep it off the public internet
  4. Never expose a database admin account to the internet
  5. Enforce egress controls so a compromised host can’t beacon out

The broader argument — for runtime behavioral detection over patch racing — has become harder to dismiss. JADEPUFFER exploited a CVE patched over a year ago, default credentials unchanged since 2020, and a signing key documented for half a decade. Waiting for the next patch is not a strategy when the attacker self-corrects in 31 seconds.

The Convergent Picture

Sysdig calls JADEPUFFER a warning sign, not a crisis. But multiple signals are now converging in the same direction. The Five Eyes security alliance warned in June 2026 that AI is “months away” from wreaking havoc on businesses and governments. The Dark Side of LLMs paper shows 82.4% of frontier models are exploitable through multi-agent trust boundaries. And now we have the first documented case of an AI agent completing the full ransomware lifecycle autonomously.

The volume will rise as agentic tools mature. The only question is whether defenders adapt at the same speed JADEPUFFER demonstrated in those 31 seconds.

JADEPUFFER indicators of compromise: C2 at 45.131.66[.]106 (beaconing on port 4444 every 30 minutes), claimed staging server at 64.20.53[.]230, ransom Bitcoin address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy, contact e78393397[@]proton[.]me, ransom table name README_RANSOM.