First agentic ransomware targets Langflow users
JADEPUFFER is the first autonomous AI ransomware: an LLM agent exploited a Langflow RCE and encrypted 1,342 production config items without any human direction.
Sysdig’s Threat Research Team published the first documented case of agentic ransomware on July 4. An attacker deployed an LLM agent named JADEPUFFER that completed a full extortion operation from initial access to encrypted ransom note without human direction.
The entry point was CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, the open-source LLM app framework. Langflow’s vendor patched it in April 2025. CISA flagged it as actively exploited in May 2025. The attack caught an unpatched instance.
The attack chain
From Langflow RCE, the agent dumped a PostgreSQL database and extracted credentials. It enumerated a MinIO object storage layer with adaptive API parsing. It established persistence through a cron job beaconing every 30 minutes. It then pivoted to a production MySQL server running Alibaba’s Nacos configuration service, exploiting a separate Nacos authentication bypass (CVE-2021-29441). The final step: AES-encrypted all 1,342 Nacos service configuration items and dropped the originals.
The agent’s code payloads contained natural-language commentary explaining each step’s purpose and why each target was prioritized. Sysdig notes this is characteristic of LLM code generation. A human operator writing one-liner exploits does not annotate their own payloads. The commentary is also a detection opportunity: LLM-generated attack code is distinguishable from human-written shellcode.
Why this matters for operators
Two things changed with JADEPUFFER. First, the skill floor for a multi-stage, adaptive intrusion dropped. The agent retried failed steps without human oversight of each move, fixing a failed login attempt in 31 seconds. Second, the target was the AI infrastructure layer itself. Langflow is used to build LLM pipelines. An attacker who controls your Langflow instance controls your pipeline.
Immediate actions: check Langflow version and apply the April 2025 patch for CVE-2025-3248 if you have not. Review which network services are co-located with your Langflow deployment. The attack pivoted from the AI framework to a production Nacos service that had no direct relationship to the pipeline.
The guide on keeping your coding agent from running attacker code covers the permission model for AI agents with tool access. The agent prompt injection brief from Sentry documented the equivalent threat at the prompt level; JADEPUFFER is the infrastructure-level version.