For a year, “AI in ransomware” meant a human criminal using a chatbot to write a better phishing email. JADEPUFFER, documented by Sysdig around 2 July 2026, is the other thing: the operation itself, recon, credential theft, lateral movement, encryption, driven by an LLM agent, running on its own.
It’s the offensive mirror of every defensive worry in this series. The same properties that make agents useful, they act autonomously, chain tools, and self-correct, are exactly what make an autonomous attacker dangerous.
TL;DR
- JADEPUFFER is the first documented end-to-end agentic ransomware, the LLM drove the whole kill chain, not just a subtask.
- Entry was an unpatched Langflow instance (CVE-2025-3248); from there the agent ran recon and harvested credentials autonomously.
- It stole AI API keys, cloud credentials and crypto wallets, moved laterally, and encrypted 1,342 Nacos config items.
- It self-corrected from a failed login to a working fix in 31 seconds, faster than any human responder can page in.
What Sysdig found
The operation started by exploiting an internet-exposed, unpatched Langflow server via CVE-2025-3248. Once inside, the agent didn’t wait for operator instructions between stages. It performed reconnaissance, harvested whatever credentials it could find, AI service keys, cloud credentials, crypto wallets, then used those to move laterally and reach the databases it ultimately encrypted: 1,342 Nacos configuration items held for extortion.
The credential-harvesting step is the hinge. This is the same secrets-sprawl reality documented in GitGuardian’s 2026 report: leaked AI-service credentials up 81% year over year, and a majority of secrets that were valid in 2022 still valid today. An autonomous agent doesn’t need a clever exploit for the second hop when the first hop hands it a working key.
31 seconds to self-correct
The number worth internalising isn’t the 1,342 encrypted items, it’s the 31 seconds. When a login failed, the agent diagnosed the problem and produced a working fix in half a minute, with no human in the loop. That collapses the defender’s response window from hours to seconds and removes the friction that used to slow attackers between stages.
Human attackers get tired, distracted, and stuck. An agent gets a stack trace and tries again.
Anatomy of the path
langflow-rce # CVE-2025-3248, unpatched, exposed → llm-agent # autonomous recon + planning → harvested-creds # AI keys, cloud creds, wallets → lateral-movement # reuse creds to reach databases → nacos-encrypt # 1,342 config items held to ransom
| Stage | Mechanism | What made it reachable | Severity |
|---|---|---|---|
| Entry | Langflow CVE | Exposed, unpatched service | High |
| Pivot | Credential harvest | Long-lived secrets on the host | Critical |
| Impact | Lateral + encrypt | Harvested creds reached prod data | Critical |
Why it’s a non-human-identity story
The exploited CVE got the headline, but the CVE only bought the first hop. Everything after, the part that turned an exposed server into an extortion event, ran on harvested credentials. Those are non-human identities: keys and tokens with standing reach into cloud and data, sitting where the first foothold could grab them.
Cut the pivot edge, the long-lived credentials the agent reaches after entry, and even a successful RCE goes nowhere. That’s the breakpoint logic again: you don’t have to win every stage, you have to sever one.
What good looks like
- Assume entry. Design so that a single foothold doesn’t hand an agent a working credential to the next system.
- Kill long-lived secrets on hosts. Short-lived, scoped credentials break the harvest-and-pivot pattern this depends on.
- Map credential reachability. Know, before the incident, which harvested key reaches production data.
- Watch machine identities for anomalies at machine speed, because the attacker moves in seconds now.
Agentic attackers make the blast radius of every leaked credential immediate. The only durable defense is knowing that radius first. Elmoz computes it.