Researchers at cloud security company **Sysdig** have uncovered a significant development in the threat landscape: the **JadePuffer** ransomware operation, believed to be the first fully automated attack orchestrated by an AI agent. ### AI Takes the Reins: An Autonomous Attack The **JadePuffer** operation demonstrated a remarkable ability to adapt to failures and refine its approach in real-time. **Sysdig** noted, "The operation also adapted in real time, retrying failed steps within refined parameters. In one sequence, it went from a failed login to a working fix in 31 seconds." This autonomous AI agent meticulously handled every stage of the attack lifecycle, including: * Reconnaissance on the target * Credential theft * Lateral movement within the network * Establishing persistence * Escalating privileges * Encrypting data ### From Initial Access to Data Encryption The attack began with initial access gained by exploiting **CVE-2025-3248**, an unauthenticated remote code execution vulnerability in **Langflow**, an open-source framework for building LLM applications. This critical flaw, patched on April 1, 2025, was later tagged by **CISA** as actively exploited in the wild, targeting internet-exposed endpoints often deployed with minimal hardening but containing valuable cloud credentials and API keys. Once code execution was achieved, the AI agent proceeded to: * Dump **Langflow**'s **PostgreSQL** database. * Collect host information. * Search for environment variables and sensitive files. * Retrieve credentials. * Enumerate a **MinIO** object store. **Sysdig** highlighted the agent's adaptive nature during **MinIO** enumeration: if an API request returned XML instead of JSON, the subsequent payload automatically adjusted its parsing logic. Persistence was established on the **Langflow** host via a cron job, configured to beacon to the attacker's infrastructure every 30 minutes. ### Pivoting and Ransomware Deployment From the compromised **Langflow** instance, the attacker pivoted to a production **MySQL** server running **Alibaba Nacos** (Naming and Configuration Service). The agent utilized root credentials, the origin of which **Sysdig** could not determine, to launch multiple payloads, including one exploiting **CVE-2021-29441**, an authentication bypass vulnerability. The agent then probed for container escape methods before deploying the ransomware payload. **JadePuffer** encrypted 1,342 **Nacos** service configuration items using **MySQL**'s `AES_ENCRYPT()` function, dropping the original `config_info` and `history` tables, and creating an extortion table named `README_RANSOM`.  The ransom note claimed AES-256 encryption, though researchers suspect the use of the weaker AES-128-ECB. Notably, the encryption key was randomly generated but neither stored nor transmitted to the attacker. ### Hallmarks of AI Control Several indicators pointed to AI control over the attack: * Detailed natural-language comments within the generated code, explaining operational reasoning. * Rapid attack iteration, adjusting based on specific encountered errors rather than simple retries. * The use of an example **Bitcoin** address in the ransom note, likely reproduced by the LLM from its training data.  **Sysdig** concludes that **JadePuffer** signals the arrival of "agentic threat actors" (ATAs), potentially lowering the barrier to entry for sophisticated cyberattacks. However, the unique operational patterns of LLM-generated payloads also present new opportunities for security solutions to enhance detection capabilities.