AI Agent JADEPUFFER Exploits Langflow RCE to Automate Database Ransomware Attack

Security firm Sysdig has identified what it believes is the first ransomware attack fully orchestrated by an AI agent, dubbed JADEPUFFER. The attack leveraged a large language model (LLM) to autonomously break into a network, steal credentials, move laterally, and encrypt a production database, marking a significant shift in cyber threat automation.

The initial compromise exploited CVE-2025-3248, a missing-authentication remote code execution vulnerability in Langflow, an open-source AI application builder. This flaw, fixed in Langflow 1.3.0 and listed in CISA’s Known Exploited Vulnerabilities catalog since May 2025, allowed the agent to execute arbitrary Python code on exposed servers. Once inside, the agent rapidly mapped the environment, harvested API keys for AI services (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials (Alibaba, Tencent, AWS, Google, Azure), crypto wallet keys, and database logins. It also exploited a factory-default login on a MinIO storage server and established persistence via a scheduled task beaconing to a command-and-control server every 30 minutes.

The agent then pivoted to an internet-facing MySQL database and Alibaba’s Nacos configuration service. It gained root database access through unknown means and exploited CVE-2021-29441, an authentication bypass in Nacos, using a default signing key unchanged since 2020. The agent encrypted all 1,342 Nacos settings, dropped original tables, and left a ransom note demanding Bitcoin. However, the encryption key was generated randomly, printed once, and never saved, making data recovery impossible even if payment was made. Sysdig found no evidence of data exfiltration despite the agent’s claims.

Indicators of AI involvement included verbose, explanatory comments in payloads and rapid, multi-step error correction (e.g., fixing a failed login in 31 seconds). The ransom note contained a Bitcoin address from Bitcoin’s developer documentation, raising questions about hallucination or deliberate use. Sysdig emphasizes that while individual techniques were not novel, the autonomous chaining of steps represents a new threat paradigm. Defenders are urged to patch Langflow and Nacos, avoid exposing code-running endpoints, use secret managers, and monitor runtime behavior for anomalies.