Sysdig researchers identified an autonomous ransomware attack executed by an AI-driven threat actor identified as JadePuffer. The campaign exploited vulnerabilities in Langflow and Nacos to exfiltrate data, encrypt configurations, and demand a ransom.

JadePuffer utilized CVE-2025-3248, an unauthenticated remote code execution vulnerability found in Langflow, an open-source tool for building AI applications. This vulnerability carries a CVSS score of 9.8, and the Cybersecurity and Infrastructure Security Agency (CISA) marked it as exploited in early May.

After compromising a Langflow instance, JadePuffer pivoted to a production server that was operating a MySQL database and an Alibaba Nacos configuration service. The threat actor subsequently enumerated the database contents, exfiltrated specific data, and then deleted the database. An extortion note was left, requesting payment for the return of the stolen information.

The attack involved payloads delivered as Base64-encoded Python through the Langflow RCE endpoint. JadePuffer scanned the system for various secrets, including API keys, cloud credentials, cryptocurrency wallets, configuration files, and database credentials, and dumped Langflow's Postgres database to harvest additional secrets. A cron job was deployed to maintain persistent access to the Langflow server.

JadePuffer also exploited CVE-2021-29441, an authentication bypass vulnerability within Nacos. The threat actor forged a valid JSON Web Token (JWT) using Nacos's default signing key and injected a backdoor administrator directly into the Nacos backing database. Subsequently, 1,342 Nacos service configuration items were encrypted.

The ransomware created an extortion table that listed a ransom demand, a payment address, and a contact email address. Sysdig observed the attack adapting in real time, with JadePuffer resolving a failed login to a functional fix within 31 seconds. The encryption key used was randomly generated but was not persisted or transmitted.

This incident represents the first documented case of a complete ransomware operation conducted autonomously by a large language model, without direct human involvement. Michael Clark, director of threat research at Sysdig, noted that the payloads contained natural language reasoning and detailed annotations. "They contained natural language reasoning, target prioritization, and the kind of detailed annotations that human operators don't often write but LLM-generated code produces reflexively," Clark said.

Clark also indicated that "An LLM agent can chain reconnaissance, credential theft, lateral movement, persistence, and destruction without the operator possessing deep expertise in any one step." Johan Edholm, co-founder of Detectify, described the actions as familiar. "Exploiting an exposed service, harvesting credentials, moving laterally, abusing default configurations, and destroying databases are all familiar parts of the playbook," Edholm said.

Edholm added that as such tooling becomes packaged and reusable, it may spread to less capable operators. He noted that "Criminal groups also tend to adopt new technology quickly because they are not constrained by procurement processes, compliance requirements, or other organisational bureaucracy." Researchers at New York University's Tandon School of Engineering developed a proof-of-concept AI-driven ransomware called PromptLock last August.