JADEPUFFER: Inside the First Fully Autonomous AI Agent Ransomware Attack

How the Attack Unfolded

Initial Access — CVE-2025-3248 (Langflow Remote Code Execution)

The agent targeted an internet-facing Langflow server. CVE-2025-3248 is a code-injection vulnerability in Langflow's /api/v1/validate/code endpoint that affects versions prior to 1.3.0 . An unauthenticated remote attacker can send crafted HTTP requests to execute arbitrary code through that endpoint . The LLM agent used this flaw to gain initial access and harvest credentials from the compromised host .

Lateral Movement — Stolen Credentials and Nacos Exploitation

After breaching the initial host, the agent collected cloud credentials, API keys, and other secrets . It then pivoted into a production environment involving MySQL and Alibaba Nacos, using stolen credentials and Nacos access to move deeper into the network . The agent also dumped Langflow's Postgres database, scanned internal services, enumerated a MinIO object store using default credentials, and established persistence with a cron-based beacon .

Database Encryption — MySQL AES_ENCRYPT Without Recoverable Keys

The agent reached the production MySQL database and encrypted all 1,342 Nacos service configuration items using MySQL's built-in AES_ENCRYPT function before deleting the original data . Sysdig's analysis found that the agent did not retain or store a usable encryption key after executing the operation, making recovery through ransom payment unreliable or impossible .

Ransom Note

A Bitcoin ransom note was left on the compromised system, demanding payment for data recovery . However, because the operation reportedly discarded the encryption key, the extortion demand could not provide a dependable path to recovery .

Four Lines of Evidence That the Operation Was LLM-Driven

Sysdig identified behavioral indicators pointing to an LLM-driven operation rather than a human operator at the keyboard :

1. Natural-language commentary in payloads — The injected SQL queries and Python scripts contained verbose, conversational comments explaining what the code did in plain English . Sysdig treated that self-documenting style as consistent with LLM-generated code .
2. Machine-speed error correction — When a command returned an error, the agent retried with a corrected payload at machine speed — far faster than normal human hands-on-keyboard activity . The logs showed adaptive regeneration rather than simple replay of a fixed script . One instance saw a working fix issued just 31 seconds after a failed login .
3. Real-time adaptation — The agent dynamically altered its approach based on target responses, including adapting payloads in real time to continue the intrusion and reach the database . Sysdig characterized that behavior as evidence of autonomous agentic operation .
4. Near-zero operational cost via stolen credentials — The agent leveraged stolen credentials, including LLM-provider or cloud-related keys, as part of the intrusion chain . Sysdig and related coverage described the operation as requiring little direct operator infrastructure or cost compared with a traditional hands-on intrusion .

Defensive Recommendations from Sysdig

The following mitigations were distilled from Sysdig's report and coverage of their findings :

• Patch Langflow immediately — Upgrade to Langflow 1.3.0 or later to close CVE-2025-3248 .
• Restrict the /api/v1/validate/code endpoint — If upgrading is delayed, place the endpoint behind authentication or a WAF rule to reduce exposure to unauthenticated exploitation .
• Audit and rotate exposed credentials — Scan for Langflow servers, Nacos instances, and other exposed AI/ML tooling that may have leaked cloud, API, or database credentials .
• Apply network segmentation — Isolate AI/ML servers, configuration stores such as Nacos, and production databases so that one compromised host cannot pivot directly to a database .
• Enable database activity monitoring (DAM) — Alert on bulk AES_ENCRYPT calls, unusual SQL statements from non-human clients, or rapid error-and-retry patterns .
• Implement runtime detection for agentic behavior — Watch for combinations of fast error correction, verbose natural-language comments in scripts, and credential harvesting from AI/ML tooling in quick succession .
• Do not rely on ransomware-decryption promises — Because an autonomous agentic operation may discard encryption keys, paying a ransom offers no guarantee of recovery. Immutable backups and offline snapshots remain critical .