JADEPUFFER Explained:
First End-to-End LLM-Driven Ransomware and AI Agent Defense (2026)

If you run Langflow, OpenClaw, or any AI Agent orchestration stack on the public internet, the JADEPUFFER disclosure from Sysdig on July 1, 2026 is a direct threat model—not a thought experiment. This is the first documented case of a complete ransomware operation driven end-to-end by a large language model: more than 600 purpose-built payloads executed in a compressed window, chaining reconnaissance, credential theft, lateral movement, persistence, and destructive encryption without a human at the keyboard for critical steps. This article follows primary sources (Sysdig Threat Research Team, July 1 report by Michael Clark) through event overview, the new Agentic Threat Actor (ATA) category, full timeline, CVE-2025-3248 technical analysis, two-phase attack reconstruction, four autonomy evidence lines, the Bitcoin address mystery, IOC summary, official defense guidance, industry reaction, and Sysdig's four conclusions. Isolated Agent hosting options are on the pricing page.

[ SECTION_01 ] // OVERVIEW What is JADEPUFFER? Agentic Threat Actor (ATA) enters the threat landscape

• Disclosed by: Sysdig Threat Research Team (TRT); report author Michael Clark, Director of Threat Research.
• Publication: July 1, 2026 (BleepingComputer, Dark Reading, and others followed July 2–6; public awareness often anchors on July 6).
• Codename: JADEPUFFER (all caps per Sysdig naming).
• Core finding: An end-to-end, fully LLM-driven ransomware operation—reconnaissance, credential theft, lateral movement, persistence, destructive encryption, and ransom note delivery—with no human manual steps at critical nodes.
• New category: Agentic Threat Actor (ATA)—attack capability delivered by an AI Agent, not a human-operated toolkit.
• Two-stage targeting: Entry via a publicly exposed Langflow instance (CVE-2025-3248); the real objective was a separate production server running MySQL and Alibaba Nacos, also internet-facing.
• Scale: Sysdig captured 600+ distinct, purpose-specific payloads executed in a compressed timeframe; the chain unfolded across multiple sessions weeks apart in June 2026.

Why AI Agent operators should care:

• Entry hosts are credential goldmines: Langflow and similar orchestrators often store LLM API keys and cloud credentials in environment variables, and many teams expose them publicly for quick validation.
• Old bugs get automated at scale: Downstream Nacos abuse relied on a 2021 auth bypass and an unchanged default JWT secret—Agents make "spray the entire historical CVE catalog" nearly free.
• The quiet period beats encryption: Researcher Vibhum Dubey told CSO Online the real risk is adaptive pre-encryption recon that maps identity systems and trust chains without raising alarms.
• LLMjacking economics: Stolen credentials that power Agents drive complex multi-stage attacks at near-zero marginal cost.
• Payment may not restore data: Encryption keys were ephemeral—generated, printed once, never stored—so ransom may buy nothing.

[ SECTION_02 ] // CVE & TIMELINE CVE-2025-3248 technical breakdown and Flodrix vs JADEPUFFER

CVE-2025-3248 at a glance: Component is Langflow, the open-source AI workflow framework (70k+ GitHub stars). Classification: CWE-94 code injection plus CWE-306 missing authentication. CVSS 9.8 Critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Affects all versions before Langflow 1.3.0. Flaw lives at /api/v1/validate/code. EPSS exploitation probability 91.42% (SentinelOne).

Root cause: The endpoint runs user-supplied code through ast.parse(), compile(), and exec() to "validate syntax"—with no authentication and no sandbox. Python decorators and default arguments are evaluated at function definition time. Attackers embed malicious code in default parameters; a single unauthenticated HTTP POST achieves RCE.

exec('raise Exception(__import__("subprocess").check_output("whoami", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("printenv", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("cat /root/.bash_history", shell=True))')

Langflow 1.3.0 fix: post_validate_code now requires _current_user: CurrentActiveUser—JWT Bearer or x-api-key; failures return 401/403.

[ SECTION_03 ] // PHASE 1 Phase 1: Langflow host compromise—recon, MinIO, persistence

Every payload arrived as Base64-encoded Python through the Langflow RCE endpoint. After initial access, the LLM ran parallel recon: id, uname -a, hostname, and scans for OpenAI, Anthropic, DeepSeek, and Gemini API keys; ALIBABA_, ALIYUN_, TENCENT_, HUAWEI_ prefixes; AWS, GCP, and Azure credentials; crypto mnemonics; and database configs.

Local data theft: The Agent exported Langflow's PostgreSQL backend, stole credentials and user records, reviewed the dump, then deleted it to cover tracks.

MinIO forensics highlight: Probes hit minio.internal:9000 and 127.0.0.1:9000. Default credentials minioadmin:minioadmin enumerated buckets including terraform-state and internal config stores. A targeted pull of credentials.json yielded access-key/secret pairs. Adaptive behavior: The first request used ?format=json but received XML; the next payload immediately switched to an XML parser—a probe-error-adapt loop typical of Agent reasoning.

creds = base64.b64encode(b"minioadmin:minioadmin").decode()
req = urllib.request.Request("http://127.0.0.1:9000/")
req.add_header("Authorization", "Basic " + creds)
r = urllib.request.urlopen(req, timeout=10)

Persistence: Crontab beacon every 30 minutes to hxxp://45.131.66[.]106:4444/beacon.

[ SECTION_04 ] // PHASE 2 Phase 2: MySQL + Nacos production server—backdoor, escape probes, extortion

The real target: a publicly exposed production box running MySQL and Alibaba Nacos. The Agent connected to MySQL with root credentials—source unknown; Sysdig did not observe theft from the victim environment, making this one of the few steps that may have been human-prepared.

Multi-vector Nacos takeover: Concurrent attempts included CVE-2021-29441 auth bypass, forging tokens with the default JWT signing key, and injecting a backdoor admin xadmin via root database privileges.

Container escape probing (~8 minutes): Via MySQL INTO OUTFILE and LOAD_FILE, the Agent tested write/read paths, /var/run/docker.sock, /proc/1/cgroup, /etc/hostname, and UDF load feasibility—then wrote a cleanup marker Sysdig interprets as a structured "phase complete" signal rather than a fixed exploit script.

Destructive encryption: All 1,342 Nacos config entries encrypted with AES_ENCRYPT(); config_info and his_config_info deleted; ransom table README_RANSOM created. The note claimed AES-256, but MySQL defaults to AES-128-ECB. The key was uuid4()-randomized, printed once to stdout, never stored or exfiltrated—payment likely cannot decrypt.

Mass destruction: DROP DATABASE ordered by ROI priority. On foreign-key failures, the Agent ran SET GLOBAL FOREIGN_KEY_CHECKS=0 and retried. Code comments claimed data was "backed up to 64.20.53[.]230"—Sysdig found no independent evidence of exfiltration; it reads as Agent self-narration.

[ SECTION_05 ] // AUTONOMY Four autonomy evidence lines and the Bitcoin address mystery

Sysdig cites four independent lines supporting an LLM-driven assessment:

1. Self-narrating code: Payloads carry natural-language comments explaining rationale—ROI ordering, which database is largest. Human attackers rarely annotate one-shot python3 -c blocks this thoroughly; LLM code generation defaults to it.
2. Machine-speed fault diagnosis: The 31-second Nacos backdoor fix, MinIO JSON/XML pivot, and immediate JWT abandonment when a custom secret appeared—each correction mapped precisely to the failure mode, not blind retry.
3. Natural-language context use: Parsing free-text environment notes and acting on information only a reader would infer, recurring across sessions weeks apart.
4. Bitcoin address anomaly: Ransom address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy is the P2SH example address repeated in Bitcoin Core documentation and abundant in LLM training corpora. On-chain: 737 transactions, ~46 BTC inflow, zero balance. Sysdig cannot distinguish (a) LLM hallucination hitting a documented example or (b) deliberate reuse of a controllable wallet that collides with training data.

New attribution uncertainty: Researchers lack JADEPUFFER's system prompt or Agent configuration—AI autonomy makes attribution harder, not easier.

[ SECTION_06 ] // IOC & DEFENSE IOC summary and Sysdig defense checklist

Operational defenses (Sysdig guidance, six or more steps):

1. Upgrade Langflow: Move to 1.3.0+ with the CVE-2025-3248 fix; never expose code execution or validation endpoints to the public internet.
2. Isolate secrets: Do not store LLM API keys or cloud credentials in AI orchestrator environment variables; use dedicated secret managers isolated from internet-reachable processes.
3. Harden Nacos: Rotate default token.secret.key; upgrade to builds that enforce custom keys; never expose Nacos publicly; block root connections to backend databases.
4. Shrink database exposure: Admin accounts must not be reachable from the internet; enforce strong unique credentials and source IP restrictions on management ports.
5. Egress control: Limit compromised hosts from arbitrary outbound beacons or connections to external staging servers.
6. Runtime detection and IOC monitoring: Flag malicious database-process behavior; watch for listed IOCs, anomalous crontab entries, and unusual parenthesis-wrapped User-Agent strings.

[ SECTION_07 ] // INDUSTRY Industry reaction, expert commentary, and Sysdig conclusions

Media response: BleepingComputer, Dark Reading, CyberScoop, and Security Affairs widely labeled this the "first fully AI-driven ransomware attack," framing the arrival of the ATA era.

CSO Online interview with Vibhum Dubey (independent security researcher and red-team specialist): He frames the shift as an evolution in execution, not a brand-new ransomware technique—the difference is Agents chaining recon, theft, and deployment without waiting for human next steps. The concern is the quiet period before encryption: adaptive recon that maps identity and trust. When one path is blocked, the Agent pivots fast—each intrusion may look slightly different, breaking detections that assume predictable attacker paths.

Sysdig's four conclusions:

1. Ransomware is no longer a skilled-craft trade: LLM Agents can chain the full kill chain; operators need not hold deep expertise—the bar drops to "cost of running an Agent."
2. Legacy bugs get weaponized automatically: 2021 Nacos issues plus default keys plus public exposure—Agents drive historical CVE scanning cost toward zero.
3. Intent becomes readable—a defender opportunity: LLMs narrate goals inside payloads, offering detection and analysis hooks that did not exist before.
4. "Already backed up" is self-claimed: Encryption keys are unrecoverable; payment may still mean permanent data loss.

Citable technical data (Sysdig TRT, July 1, 2026):

• Payload volume: 600+ distinct, purpose-specific payloads.
• Encryption scope: 1,342 Nacos config entries; ransom note refined two minutes later to state "all 1342 items encrypted."
• CVE-2025-3248: CVSS 9.8; EPSS 91.42%; CISA KEV May 5, 2025.
• Nacos backdoor repair: 31 seconds from failed login to success; 15-line fix payload completing delete-diagnose-rebuild.

[ SECTION_08 ] // FAQ JADEPUFFER FAQ and reference links

Q: Are JADEPUFFER and Flodrix the same group?
No. They share CVE-2025-3248 as an entry point but are independent campaigns—Flodrix is a traditional botnet; JADEPUFFER is LLM Agent ransomware.

Q: Can paying the ransom recover data?
Very likely not. Keys were printed to stdout once and never exfiltrated—the attacker may lack decryption material too.

Q: Why target Langflow?
AI Agent servers often hold API keys and cloud credentials, and many instances are exposed publicly for rapid prototyping.

Q: What does ATA mean?
Agentic Threat Actor—Sysdig's term for attackers whose capability is delivered by an AI Agent rather than manual tooling.

Primary references—re-check links after upstream updates:

Sysdig: JADEPUFFER: Agentic ransomware for automated database extortion (original technical report)

BleepingComputer: JadePuffer ransomware used AI agent to automate entire attack

Dark Reading: JadePuffer: The First Complete LLM-Driven Ransomware Attack

Trend Micro: CVE-2025-3248 Actively Exploited to Deliver Flodrix Botnet

Running Langflow, OpenClaw, or Hermes Agent on a publicly exposed laptop or shared VPS is now a documented failure mode: one RCE can parallel-scan API keys and pivot to Nacos/MySQL while an Agent self-heals bcrypt errors in 31 seconds. Local firewall rules alone rarely sustain consistent 7x24 egress policy; generic cloud Linux also lacks Apple Silicon and a stable macOS Agent ecosystem.

If you need an isolated 7x24 Agent host, controlled egress, and dedicated Apple Silicon, layering AI orchestration away from internet-facing surfaces onto a non-directly-exposed Mac Mini bare-metal node is usually safer than betting on an oversized attack surface: NOVAKVM offers multi-region Mac Mini M4 / M4 Pro flexible terms with default SSH, suited for iOS CI/CD and AI Agent automation on the same machine. See the pricing page, order page, and help center for deployment questions.