On July 1, 2026, security firm Sysdig Threat Research Team (TRT) published a report disclosing the world's first end-to-end ransomware attack independently executed by an AI agent—JADEPUFFER. The attack did not rely on novel zero-day exploits but leveraged a known high‑severity Langflow service vulnerability (CVE-2025-3248), enabling remote execution of arbitrary Python code. Using large language models (LLMs), the agent autonomously carried out the full chain from initial access, lateral movement and credential theft to database encryption and extortion. This incident marks a shift of AI agents from defensive tools to offensive weapons, raising deep industry concern about AI-driven cyber threats.

Sysdig defines JADEPUFFER as an Agentic Threat Actor (ATA), i.e., a threat actor driven by AI agents rather than human operators. The attack process demonstrated high adaptability and autonomy, illustrating AI's potential in cybercrime.

Attack chain reconstruction: the AI agent's "autonomous decision" capability

According to Sysdig's detailed report, JADEPUFFER's attack flow was highly automated:

Initial access: Exploited internet‑exposed Langflow instances using CVE-2025-3248 (missing authentication) to remotely execute arbitrary Python code. This vulnerability has been listed by CISA among known exploited vulnerabilities.
Environment reconnaissance and credential theft: The agent autonomously scanned the environment and harvested API keys, cloud credentials (including Alibaba Cloud, Tencent Cloud, AWS) and database credentials.
Lateral movement and persistence: Leveraged Nacos configuration service vulnerabilities (e.g., CVE-2021-29441) and default keys to implant backdoor administrator accounts and established cron jobs on Langflow servers for persistence.
Core disruption: Located production database servers, used root privileges to encrypt Nacos configuration items (a total of 1,342 entries), and deleted database tables, leaving a ransom note and a Bitcoin payment address.
Self‑narration and adaptation: The payload contained natural‑language reasoning, target prioritization and detailed annotations, enabling real‑time adaptation to failed steps (for example, recovering from a login failure to remediation within 31 seconds).

The entire process showed no obvious human intervention; the LLM made autonomous decisions and executed actions, demonstrating an end‑to‑end Agentic Ransomware operation. Sysdig emphasized this is the first observed complete instance of such an attack.

Root causes: the combination of known vulnerabilities and AI autonomy

JADEPUFFER did not employ new exploits but skillfully abused publicly known and even patched CVEs, highlighting the following issues:

Exposed service risk: Langflow, an open‑source AI workflow builder, is widely used in production, but misconfigurations can expose instances to the public internet.
AI agents as a double‑edged sword: Attackers can use LLMs as the "attack brain," endowing them with planning, adaptation and execution capabilities that greatly lower the threshold for complex attacks.
Supply chain and configuration weaknesses: Common issues such as Nacos default keys and weak passwords are rapidly exploited by AI agents.

This attack model indicates that future threats may rely less on complex malware and more on AI‑driven intelligent decision chains to achieve efficient disruption.

Far‑reaching impact: AI security enters a new risk era

1. Impact on the cybersecurity landscape

Attack democratization: Low technical barriers for AI agent ransomware mean smaller attackers ca