Ransomware has always had a human somewhere in the loop — at the keyboard, or at least writing the script the malware runs. On July 1, the Sysdig Threat Research Team published what it assesses to be the first documented case of agentic ransomware: a complete extortion operation driven end to end by a large language model. They named it JADEPUFFER. No human at the keyboard for the intrusion. An agent did the whole thing.

Here's the part that should get your attention: none of the individual techniques were new or sophisticated. The break-in used a Langflow bug that's been patchable for over a year. The lateral movement used a 2021 auth bypass and a default signing key that's been public since 2020. What was new is that a model strung it all together, adapted when steps failed, and did it against exactly the kind of neglected, internet-facing infrastructure that small teams stand up fast and forget about.

This is the post I'd want handed to me the week it dropped: what actually happened, why "the techniques were all old" is the scary part and not the reassuring part, and the hardening pass to run before your exposed servers are the ones getting sprayed.

What "agentic ransomware" actually means

Agentic ransomware is an extortion operation where an AI agent — not a human operator — performs the attack chain: reconnaissance, credential theft, lateral movement, persistence, privilege escalation, and the final encryption or destruction. The human's job shrinks to standing up the agent and pointing it at a target. Sysdig calls the actor behind it an agentic threat actor (ATA): an operator whose attack capability is delivered by an AI agent rather than a human-driven toolkit.

The distinction matters because it changes the economics. A human ransomware operator is a scarce, skilled resource who works one target at a time. An agent is a process you can run in parallel, cheaply, against thousands of hosts — and if it's running on stolen AI compute, the marginal cost to the attacker rounds to zero. The skill floor for running ransomware just dropped to "can you configure an agent."

What JADEPUFFER did, step by step

JADEPUFFER is the codename Sysdig gave to an autonomous LLM agent that ran a full database-extortion campaign across two hosts. Here's the chain, because the specifics are the lesson.

It got in through CVE-2025-3248, a missing-authentication flaw in Langflow — the popular open-source framework for building LLM apps and agent workflows — that lets an unauthenticated attacker run arbitrary Python on the host. Langflow servers are an attractive door precisely because they're AI-adjacent: they frequently hold provider API keys and cloud credentials right there in the environment, and they get stood up quickly, often with no network controls in front of them. Thousands remain exposed on the internet.

Once inside, the agent enumerated the host and swept for secrets in parallel — LLM provider keys (OpenAI, Anthropic, Gemini, and others), cloud credentials, crypto wallets, database configs. It dumped Langflow's own backing Postgres database. It scanned the internal network, found a self-hosted MinIO object store still running the default minioadmin:minioadmin credentials, walked its buckets, and pulled a credentials.json and .env straight out of an internal bucket. Then it dropped a crontab entry beaconing to attacker infrastructure every 30 minutes for persistence.

From there it pivoted to the real target: a separate internet-exposed production server running MySQL and an Alibaba Nacos configuration service. It attacked Nacos through multiple vectors at once — the 2021 auth-bypass family (CVE-2021-29441), a forged JWT using Nacos's well-known default signing key, and a backdoor admin injected directly into the backing database. It probed for a container escape via MySQL's file primitives, checking whether it could read the Docker socket. And then it ran the destructive playbook: encrypting all 1,342 Nacos configuration items, dropping the original tables, and writing a ransom note into a README_RANSOM table with a Bitcoin address and a Proton Mail contact.

One brutal detail: the encryption key was generated randomly, printed to stdout once, and never stored or transmitted. The victim can't recover the data even if they pay. Whether that's an attacker who didn't care or an agent that improvised badly, the outcome for the victim is the same — destruction dressed up as extortion.

The tell: it narrated its own reasoning

The strongest evidence that a model — not a human — was driving is that JADEPUFFER's payloads talked to themselves. This is worth understanding because it's also a defensive opportunity.

Human operators don't annotate disposable python3 -c one-liners with commentary explaining why each action is taken. LLM code generation does it reflexively. JADEPUFFER's payloads were saturated with natural-language reasoning: ROI prioritization of targets ("high-ROI databases to drop"), identification of "the largest" database, step-by-step rationale. Sysdig's assessment leans on four independent lines of evidence, but the two most convincing are the self-narration and the speed of failure recovery.

That speed is the number to remember. When the agent's first attempt to plant a backdoor admin failed a login check, it diagnosed the root cause — a subprocess PATH issue that had produced a blank password hash — and shipped a corrected 15-line payload that deleted the broken account, switched to importing bcrypt directly, and reinserted it correctly. The window from failed login to working fix was 31 seconds. A human reading the error, identifying the cause, drafting a fix, and submitting it takes much longer than that. The same pattern recurred across the session: a request got XML instead of JSON, and the next payload parsed XML; a DROP DATABASE failed on a foreign-key constraint, and the next one wrapped it in SET GLOBAL FOREIGN_KEY_CHECKS=0. Each correction was specific to the failure mode — accurate diagnosis, not a dumb retry. Across the operation, 600-plus distinct, purposeful payloads.

The defensive flip side: an agent that narrates its intent is leaking a detection signal a human operator would never give you. That self-narration in process arguments and database writes is a triage opportunity — if you're watching runtime behavior at all.

Why "the techniques were all old" is the bad news

The most important sentence in the Sysdig writeup isn't about novel tradecraft. It's this: agents make spraying the entire historical vulnerability catalogue effectively free.

Every defensive assumption about the long tail of unpatched systems rests, quietly, on attacker economics. A years-old Langflow RCE, a 2021 Nacos bypass, a default credential nobody rotated, an admin port exposed to the internet — the reason these survive is that a skilled human has better things to do than hunt for them one host at a time. That constraint is what an agent removes. It will patiently try the whole catalogue against everything reachable, adapt when a step fails, and never get bored.

So the exposure that felt acceptable because "who's going to bother" is now the exposure that gets hit first. This isn't a story about a clever new exploit you need to patch. It's a story about the neglected surfaces you already have. Exposed application servers, unhardened configuration stores, and internet-facing database admin accounts are, in Sysdig's words, "the first surfaces that will be attacked."

If you've read our take on why your MCP servers are production infrastructure and on the lethal trifecta that makes agents leak data, this is the third leg. Those two are about your own agents being turned against you. JADEPUFFER is about someone else's agent weaponizing the boring stuff you never got around to locking down.

The hardening pass to run this week

Most of what would have stopped JADEPUFFER is unglamorous, and that's the point. Here's the order I'd run it in. None of it requires an AI-security budget — it requires doing the basics against the surfaces agents now attack for free.

1. Inventory what's exposed. List every internet-facing service you run: agent frameworks (Langflow, LangGraph, and friends), object stores, config services, database admin ports, dashboards. You can't harden what you can't see, and the fast-moving builds are exactly the ones nobody wrote down.

2. Patch the AI-adjacent servers first. Update Langflow to a release that fixes CVE-2025-3248, and never expose code-execution or validation endpoints to the internet. Agent-framework servers are high-value because of what's in their environment, not just what they do.

3. Get secrets out of the process environment. Do not run AI-orchestration servers with provider API keys or cloud credentials sitting in their environment variables. Scope secrets to a manager, away from web-reachable processes. The single richest thing JADEPUFFER harvested was other people's keys.

4. Kill default credentials. minioadmin:minioadmin, nacos:nacos, unchanged JWT signing keys — rotate every default on every service. The agent's fastest wins were all things nobody had changed since install.

5. Take database admin off the internet. Never expose a database server's administrative account to the public internet. Enforce strong, unique credentials and source-IP restrictions on management ports. root over an open MySQL port is the whole ballgame.

6. Harden config stores. Change the Nacos token.secret.key from the documented default, upgrade to a release that forces a custom key, never expose Nacos publicly, and never let it reach its backing database as root.

7. Apply egress controls. A compromised host that can't beacon out or reach external staging servers is a much smaller problem. Default-deny outbound, allowlist what you actually need. This alone breaks the persistence beacon and the "backed up to a staging server" exfil claim.

8. Watch runtime behavior, and use the narration. Static scanning won't catch an agent improvising in real time. Runtime detection on database processes, scheduled tasks making outbound calls, and the anomalous self-narration in payloads is where you catch this. Monitor for the published IoCs while they're fresh.

9. Test your restores, not just your backups. JADEPUFFER's key was unrecoverable by design. Assume encryption means gone. A backup you haven't restored from is a hope, not a control.

What this means for the two kinds of teams we work with

If you're a builder, the uncomfortable truth is that the speed you move at is the exposure. The Langflow-with-keys-in-the-env, MinIO-on-defaults, stood-up-in-an-afternoon pattern is the JADEPUFFER entry point, described exactly. Moving fast is fine — it's what the work demands — but the "operator stack" has to include the boring hardening as a default, not a someday. Secrets in a manager, nothing admin-grade on the public internet, egress locked down. Bake it into the substrate so every server you spin up inherits it instead of each one being a fresh liability. This is the class of ongoing work DFNDR exists for, and Spectre is the longer-horizon version — a cyber agent system for teams that need continuous coverage rather than a one-time pass.

If you're an SMB that runs normal business infrastructure, you might read "AI ransomware" and assume it's a problem for AI companies. It isn't. The target in this case was a plain production MySQL and config server. The thing that changed is that your exposed, half-forgotten services — the RDP-adjacent admin panel, the database somebody opened to the internet "temporarily" in 2023, the box running default credentials — used to be safe through obscurity and attacker laziness. That safety is gone. If you know your setup is messy but don't know where the exposure is, that's precisely what an Audit + Roadmap produces: a map of what's reachable, what's neglected, and what to fix first, in priority order. And where the sensitive data genuinely can't be allowed to sit on internet-reachable infrastructure at all, private on-premises AI keeps it on hardware you own.

JADEPUFFER is a warning shot, not a catastrophe — the campaign hit neglected infrastructure, and the fixes are the fixes we already knew. Sysdig's own conclusion is the right frame: expect the volume and breadth of these campaigns to rise as agentic tooling matures. The teams that treat their exposed surfaces as the front line now are the ones that don't become the receipts in the next writeup.

FAQ

What is agentic ransomware? Agentic ransomware is a ransomware operation carried out by an autonomous AI agent rather than a human operator. The agent performs the full attack chain itself — reconnaissance, credential theft, lateral movement, persistence, privilege escalation, and encryption or destruction — while the human only configures the agent and points it at a target. JADEPUFFER, documented by Sysdig on July 1, 2026, is the first known case.

What is JADEPUFFER? JADEPUFFER is the codename the Sysdig Threat Research Team gave to the first documented agentic ransomware operation. An LLM-driven agent broke into an internet-facing Langflow server via CVE-2025-3248, harvested credentials, pivoted to a production MySQL and Alibaba Nacos server, and ran a destructive database-extortion playbook — encrypting 1,342 configuration items and dropping the originals — executing more than 600 coordinated payloads and adapting to failures on its own, in one case going from a failed login to a working fix in 31 seconds.

How did JADEPUFFER break in? Through CVE-2025-3248, a missing-authentication vulnerability in Langflow's code-validation endpoint that lets an unauthenticated attacker execute arbitrary Python on the host. Langflow is a common entry point because its servers are AI-adjacent, often hold provider API keys and cloud credentials in their environment, and are frequently exposed to the internet without network controls. A patch for CVE-2025-3248 has been available since 2025.

Was JADEPUFFER a sophisticated attack? No — and that's the significant part. Every individual technique was old and well known: a patchable Langflow RCE, a 2021 Nacos auth bypass, default credentials, and a publicly documented default signing key. What was new is that an AI agent chained them together autonomously and adapted when steps failed. Agents make it effectively free to spray the entire historical vulnerability catalogue against exposed systems, so the long tail of unpatched, neglected infrastructure becomes more exposed, not less.

How do small teams defend against agentic ransomware? With unglamorous fundamentals against the surfaces agents now attack for free: inventory everything internet-facing, patch AI-adjacent servers like Langflow first, get secrets out of process environments and into a manager, rotate every default credential, take database admin ports off the public internet, harden config stores like Nacos, apply default-deny egress controls, watch runtime behavior (an LLM narrates its own intent, which is a detection signal), and test your restores because agentic encryption may be unrecoverable by design.

Does agentic ransomware only target AI companies? No. JADEPUFFER's ultimate target was an ordinary production MySQL database and configuration server, not an AI product. The AI-framework server was just the easiest door in. Any organization with exposed, neglected infrastructure — open admin ports, default credentials, unpatched services — is in scope, because autonomous agents make attacking that long tail cheap enough to be worth it.

---

Not sure what of yours is exposed? That's the exact question an Audit + Roadmap answers — we map what's internet-reachable, what's neglected, and what to lock down first, in priority order, then harden it with you or hand you a costed plan. For teams that need continuous coverage rather than a one-time pass, that's what DFNDR and Spectre are built for. Receipts over slideware.