SELINA.ai
Sign in
security

JadePuffer: What the First Fully Autonomous LLM-Driven Ransomware Attack Actually Changed About Security

In early July 2026, Sysdig's Threat Research Team published findings on an operation they called JadePuffer — what they assess to be the first documented case of a large language model executing a complete ransomware chain without a human operator at the keyboard. The security implications are real, but they're not the ones most headlines are selling you. The actual lesson is quieter, more uncomfortable, and mostly about things we already knew but hadn't fixed.

Key Takeaways

What Actually Happened in the JadePuffer Attack?

An LLM agent exploited an internet-facing Langflow instance via CVE-2025-3248, a critical missing-authentication vulnerability that CISA had flagged as actively exploited back in early May. The agent then pivoted to a production server running MySQL and Alibaba's Nacos configuration platform, encrypting 1,342 Nacos configuration records, deleting the original tables, and leaving a Bitcoin ransom demand. The operation ran more than 600 coordinated payloads.

Sysdig's disclosure dates the attack itself to late June 2026. The incident hasn't been publicly confirmed by the victim, law enforcement, or another security firm. That matters. It's a single-source assessment. But the technical detail in the writeup is specific enough to take seriously.

What Made This Different From Scripted Attacks?

Self-correction under novel failure conditions. That's the line between automation and agency.

In one documented sequence, the agent failed to create an administrator account in Nacos, diagnosed the root cause, and fixed it — all within 31 seconds. This wasn't blind retry logic. The agent reasoned about what went wrong, adjusted its approach, and succeeded on the next attempt. A traditional script would have either retried the same payload or stopped.

The payloads were also what Sysdig called "self-narrating" — they contained natural-language reasoning, target prioritization, and detailed annotations. The kind of verbose commentary human operators don't typically write but LLM-generated code produces reflexively. More on why that matters — and why it won't last — below.

Was There Really No Human Involved?

Not entirely. The MySQL root credentials the agent used were not lifted from the victim's environment, meaning a person almost certainly obtained them through a prior compromise. And Sysdig found evidence that multiple models were used in the attack. So the accurate framing is: a human set the table, and the agent ran the dinner.

That distinction matters. JadePuffer isn't "AI replaces attackers." It's "AI lets one attacker run operations that previously required a team." The skill floor dropped. The economics changed. Sysdig's Michael Clark put it flatly: "The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero."

Why Did the Attack Actually Succeed?

Because the target environment had the same problems most environments have — and none of them required AI to exploit.

Start with the entry point: CVE-2025-3248 is a missing-authentication vulnerability in Langflow. Missing authentication. Not a subtle logic bug or a zero-day. A service exposed to the internet without auth, running a known-vulnerable version weeks after CISA flagged it. The patch existed. It wasn't applied.

Then the pivot: the agent swept for API keys, cloud credentials, database logins, and crypto wallet keys. Your AI orchestration layer — Langflow, LangChain, whatever you're running — stores secrets in memory, in config files, in environment variables. It's a credential vault sitting on the open internet, and most teams don't treat it that way.

Then the target: a MySQL instance with root credentials that a human had already compromised, plus a Nacos platform using — based on the attack chain — default or weak authentication. These are 2019-era problems wearing 2026-era clothes.

Is the Real Story About AI or About Infrastructure Hygiene?

Infrastructure hygiene. The AI part is real, but it's an accelerant, not the fuel. Every individual technique JadePuffer used — exploiting an unpatched RCE, sweeping for credentials, pivoting between services, encrypting databases — is documented in MITRE ATT&CK. None of it required an LLM. The LLM just executed the whole playbook faster, more adaptively, and without needing to sleep.

The uncomfortable implication: if your environment would have survived a competent human attacker using these same techniques, it would have survived JadePuffer. If it wouldn't have — and 82% of organizations have discovered shadow AI agents operating outside their visibility — then the problem isn't that attackers got smarter. The problem is that your attack surface expanded faster than your controls did.

What Did JadePuffer Get Wrong?

A lot, actually. And that's instructive.

The ransom note's Bitcoin address was a public example address commonly used in documentation — the agent apparently reproduced it from training data rather than generating a real payment destination. And the AES encryption key? Generated at random, printed once to stdout, and never stored or transmitted. There is no key the attacker can hand over. Paying the ransom would not restore data.

This is both reassuring and terrifying. Reassuring because this particular attack was — in the most literal sense — a failed extortion. The attacker couldn't have collected payment even if the victim tried to pay. Terrifying because the operational execution was sound. The data is still gone. The encryption still happened. The mistakes were in the LLM's understanding of cryptocurrency logistics, not in its ability to compromise infrastructure.

Next time, the Bitcoin address will be real.

Should You Rely on LLM Mistakes for Detection?

No. The self-narrating payloads, the hallucinated Bitcoin address, the verbose code comments — these are incidental artifacts of how current models generate text. They're not a durable detection signal.

Today's agentic attacks are still showing their work by accident. The next generation won't be. A model prompted to suppress commentary will suppress commentary. A model given a real wallet address will use it. The self-narrating quality of JadePuffer's payloads gave defenders a useful tell this time. Building a detection strategy around that tell would be like building a burglar alarm that only triggers when the burglar talks to himself.

What Detection Signals Actually Hold Up?

Behavioral tempo. The 31-second self-correction cycle is the real signal — not what the agent said, but how fast it iterated.

Multiple vendors are pushing detection toward runtime behavioral monitoring rather than static signatures. The patterns to watch for: sub-minute retry loops with semantic variation between attempts (not identical retries — actual reasoning about different approaches), coordinated multi-step pivots that complete faster than a human could type, and mass database operations preceded by schema enumeration.

These are harder to detect than malware hashes. They require understanding what normal automation looks like in your environment — which means you need to actually know what normal automation looks like in your environment. Most organizations don't.

What Does the Credential Governance Gap Look Like?

It looks like the gap between what your IAM system controls and what your AI agents can actually reach — and right now, that gap is wide.

A Cloud Security Alliance survey published around the same time as the JadePuffer disclosure found that only 18% of organizations are highly confident their identity and access management systems can govern AI agents. Static API keys, shared service accounts, and username/password combinations remain the most common authentication methods for agent access. That same survey found 65% of organizations had already experienced at least one AI-agent-related security incident in the past year.

The agent that ran JadePuffer didn't pick the lock. It used a key that was lying around. That's the story of most breaches, AI-driven or not. But agent-based architectures amplify the problem because they concentrate secrets — API keys, database credentials, cloud tokens — in orchestration layers that weren't designed as secret stores and aren't hardened like one.

How Should You Think About Your AI Orchestration Layer?

Treat it as a credential vault sitting on the open internet — because that's what it is.

If you're running Langflow, LangChain, CrewAI, or any agent framework in production, it probably has access to: API keys for frontier model providers, database credentials, cloud service credentials, and possibly customer data. It's the highest-value target in your stack, and it's likely running with broader permissions than any single human in your org.

Least-privilege by design. No plaintext keys in agent environments. No default credentials on any backing service. No exposed orchestration endpoints without authentication. These are boring recommendations. They're boring because they've been correct for twenty years and most organizations still haven't fully implemented them.

Is JadePuffer a Revolution or an Evolution?

Evolution — with a caveat.

Expert reaction has split on this. Some researchers call it "an evolution rather than a revolution" since the individual TTPs were already known. The counterargument, from Sophos's CISO: AI doesn't fundamentally change attacker behavior, but it has a big impact on speed and scale.

Both are right, and neither is complete. The individual techniques are old. The combination — a single autonomous agent running the full chain, adapting in real time, at near-zero marginal cost — is new. Not because any single capability is novel, but because the economics changed. An attack that previously required a skilled operator for hours can now run unsupervised for the cost of API calls. And if those API calls are running on stolen credentials via LLMjacking, the cost drops to near zero.

The right mental model: it's like the difference between a lockpick and a lockpick attached to a robot arm that can try every lock on the block while you sleep. Same tool. Different throughput. Different economics.

What Does This Mean for How We Build?

We build Selina as a personal AI assistant, not a security product. But the design philosophy matters here because the same principles that protect your conversations from us also limit what an attacker could extract if they compromised an adjacent system.

Files and transfers through SelinaSEND are end-to-end encrypted — zero-knowledge, meaning we can't read them. Memory is a different story: memory is NOT end-to-end encrypted. It's encrypted at rest, but a slice of each request reaches a frontier provider at inference time. We state this plainly because the honest limit is the point. You should know exactly where the encryption boundary is.

Non-content operational metadata is kept for a short retention window — not zero retention. Your account is protected; your content is encrypted. These are different verbs for a reason.

The JadePuffer attacker's first move after breaching Langflow was sweeping for API keys and credentials. In our architecture, there's no plaintext credential store for an agent to sweep. The attack surface you expose through your AI tools is a design choice, not an inevitability.

What Should You Actually Do Right Now?

Patch CVE-2025-3248 if you haven't. That's first. It's been months.

Then, the less obvious list:

None of this is new advice. That's the point. JadePuffer didn't exploit a gap in our defenses against AI. It exploited the same gaps we've had for years — just faster, and without needing a human to stay awake.

Where Does This Go From Here?

Sysdig's team has been tracking a trajectory: they noted their own earlier discovery of the first in-the-wild LLM agent intrusion via a Marimo CVE, and Sophos's discovery of a live AI malware lab hunting EDR bypasses, as predecessors pointing toward exactly this outcome. JadePuffer is a waypoint, not a destination.

The next iteration won't hallucinate its Bitcoin address. It'll use a real wallet. The encryption key won't be printed to stdout and discarded — it'll be exfiltrated to an attacker-controlled server before the ransom note drops. The self-narrating payloads will be stripped of their commentary. The 31-second fix cycle will get faster.

And the defense that works against all of that is the same defense that would have worked against JadePuffer: patch your known vulnerabilities, lock down your credentials, monitor behavior at runtime, and treat your AI orchestration layer like the crown jewel it has quietly become.

boring advice. still true.

If you're thinking about where your own data sits in all of this — start a free 7-day trial, no card required.

Frequently Asked Questions

What was JadePuffer?

JadePuffer is an operation documented by Sysdig's Threat Research Team, assessed to be the first documented case of an LLM agent executing a complete ransomware chain without a human operator at the keyboard, exploiting a Langflow vulnerability to encrypt 1,342 Nacos configuration records.

Was the attack entirely autonomous, with no human involvement at all?

Not entirely — the MySQL root credentials used were not stolen from the victim's environment during the attack itself, meaning a human likely obtained them through a prior compromise, and multiple models were used in the operation. The accurate framing is that a human set the table and the agent ran the operation.

What made this attack different from a scripted or automated attack?

The agent showed self-correction under novel failure conditions, diagnosing and fixing a failed privilege escalation attempt within 31 seconds rather than blindly retrying or stopping, and it produced 'self-narrating' payloads containing natural-language reasoning and target prioritization.

Was the vulnerability exploited something new or AI-specific?

No — the entry point was CVE-2025-3248, a known, patched missing-authentication vulnerability in Langflow that CISA had flagged as actively exploited in early May, and every other technique in the chain (credential sweeping, pivoting, encryption) was old, documented in MITRE ATT&CK, and didn't require an LLM.

Should defenders rely on the agent's mistakes, like the hallucinated Bitcoin address, for detection?

No — the hallucinated Bitcoin address and self-narrating payloads were incidental byproducts of current model behavior, not durable detection signals, since a differently prompted model could suppress commentary or use a real wallet address. Detection should instead focus on behavioral tempo, such as sub-minute retry loops and coordinated multi-step pivots.

Sources & References

Michael C.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

Learn more about Selina.ai