Something crossed a line this week in the threat landscape. Not a headline about AI being added to a vendor's product. Something more concrete: an AI agent ran a complete ransomware operation from start to finish, with no human operator issuing a single command, and the production database it hit is gone. Even if the victim paid every satoshi in the ransom demand, the data can't be recovered.
Sysdig's Threat Research Team documented it: an operation they named JADEPUFFER — the first fully autonomous, AI-agent-driven ransomware they've observed in the wild. The research dropped July 1 and spent this week getting wide analysis across the security community. If you run self-hosted AI tools in your org, this is worth ten minutes of your time.
How it got in
The entry point was CVE-2025-3248 — a missing-authentication flaw in Langflow, the popular open-source platform for building AI workflows and agent pipelines. The flaw sits in Langflow's code validation endpoint. No login required. If you can reach the server on the right port, you can run arbitrary Python on the host.
Langflow patched this in version 1.3.0. CISA added it to the Known Exploited Vulnerabilities list in May 2025. That's 14 months before this attack.
The victim's Langflow server was still on an unpatched version.
What the agent did next
Once inside, JADEPUFFER ran a methodical sweep. It dumped Langflow's internal PostgreSQL database, scanned environment variables, and crawled the filesystem for anything credential-shaped. The haul: API keys for major AI platforms, cloud credentials across AWS, Google Cloud, Azure, Alibaba Cloud, and Tencent, crypto wallet keys, and database logins.
But the Langflow server wasn't the real target. It was the doorway.
The agent pivoted to a separate production server running MySQL and Alibaba Nacos — the configuration management tool common in microservice architectures. It hit Nacos with CVE-2021-29441, a five-year-old authentication bypass that creates rogue administrator accounts. Then it used MySQL's native AES_ENCRYPT function to encrypt 1,342 Nacos service configuration records, dropped the original config and history tables, and created a new table called README_RANSOM with a Bitcoin address and a Proton Mail contact.
Attack complete. No human operator.
Why paying the ransom wouldn't help
Here's the part that changes the calculus.
The encryption key was generated locally by the agent and appeared once — in the operation logs. Then it was gone. The agent had no programmed step to save the key or send it back to whoever launched the attack. No key means no decryption. This isn't a traditional extortion model where the attacker holds your data hostage and releases it on payment. The data is destroyed. The ransom note is decoration.
This is what happens when the operational logic is AI-generated and the operator didn't think to program a key exfiltration step. You get a fully automated attack that works — and then a ransom demand that can't be honored by either side.
The other detail worth noting: when an admin-account login failed partway through the operation, the agent diagnosed the problem and issued a corrected payload 31 seconds later. Across more than 600 payloads, it wrote natural-language annotations explaining its own reasoning at each step — not because a human told it to, but because that's what LLM-generated code tends to produce. Sysdig's researchers used those annotations to reconstruct the entire decision chain.
What this means for a 15-50 person org
Two things about JADEPUFFER are worth sitting with.
First: your AI workflow server is not the target. It's the stepping stone. JADEPUFFER used Langflow to get credentials and pivot. Every database login, API key, and cloud credential that your Langflow instance — or your n8n, or your Flowise — can touch is what an attacker actually wants. Most small orgs that have deployed these tools have given them significant access to sensitive systems, usually with less hardening than a customer-facing web app would get. The compromised server is just the first door.
Second: CISA's Known Exploited Vulnerabilities list is now a real-time attack menu. CVE-2025-3248 sat on that list for 14 months before JADEPUFFER. The conventional assumption that "known vulnerabilities take time to weaponize at scale" doesn't hold when the weaponization is automated. An agentic attacker doesn't have work hours or weekends. The window between KEV publication and exploitation is compressing, and "we'll get to patching it this sprint" is no longer a safe posture.
Three things to do this week
Update Langflow to 1.3.0 or later today. Not this sprint. Today. CVE-2025-3248 is on CISA KEV, it's a no-authentication-required RCE, and we now have a documented live operation that used it. Check your running version with pip show langflow or in your admin panel. If you deployed via Docker, pull the latest image.
Stop letting AI workflow tools face the open internet. Langflow, n8n, Flowise, Dify — none of these should be reachable from the public internet without authentication and IP restrictions in front of them. If you stood one up with a public URL for convenience, get a VPN or IP allowlist in front of it this week. JADEPUFFER's entry point was a publicly reachable Langflow instance. Remove the exposure and you remove the attack vector.
Make the blast radius list. For each AI workflow tool you're running: what database logins does it have? What API keys? What cloud credentials? What OAuth tokens? Write it down. Most teams, when they actually list it out, find the answer is larger than they realized. Scope each tool's access to the minimum it actually needs, and rotate anything that's accumulated more access than it should have.
The agentic ransomware category is new. JADEPUFFER is the first documented operation, but the operational pattern isn't complex. Wiring an AI agent to enumerate credentials, identify high-value targets, and run a known exploit chain is not cutting-edge research — it's an afternoon's work for someone who knows what they're doing and has a list of unpatched servers to scan.
CVE-2025-3248 gave them the list. Unpatched Langflow deployments across the internet are still on it.
This is the kind of exposure audit we help small orgs run — what's deployed, what it can reach, and what an attacker would actually do with it. Usually half a day. Costs a lot less than the alternative.