Calling JADEPUFFER “the first agentic ransomware” invites the wrong argument. The interesting question is not whether a human disappeared from the campaign. A human did not. The useful question is how much of the technical operation moved into an adaptive machine loop, and how quickly defenders now have to react.
On July 1, Sysdig Threat Research Team published what it assesses as the first documented case of agentic ransomware. The exploit chain was familiar. The speed, target prioritization and failure recovery were not.
What Sysdig actually observed
Initial access came through CVE-2025-3248, an unauthenticated code-execution flaw in Langflow's validation endpoint. Versions before 1.3.0 were vulnerable. The fix had been available for more than a year, and CISA had added the issue to its Known Exploited Vulnerabilities catalog in May 2025.
That first host was not the final target. It was the bridge. According to Sysdig, the agent enumerated the machine, searched for provider keys, cloud credentials, wallets and database secrets, dumped Langflow's Postgres database, and scanned reachable internal services.
It then probed MinIO with default credentials and adapted when the response came back as XML rather than JSON. It established persistence through a cron beacon. From there it reached a production MySQL server behind Alibaba Nacos, tried known Nacos weaknesses and created a backdoor administrator account.
The first login failed because the generated bcrypt value was wrong. The next sequence diagnosed the cause, changed the hashing approach, recreated the account and logged in successfully. The time from failed login to the working correction was 31 seconds.
The destructive phase encrypted 1,342 Nacos configuration items with MySQL's AES_ENCRYPT(), dropped the original and history tables, and created a README_RANSOM table. The agent later disabled foreign-key checks to drop additional schemas after an earlier attempt failed.
Sysdig counted more than 600 distinct, purposeful payloads in a compressed window. Many narrated their own goals, corrections and target choices in natural language. That combination of self-narration, specific failure recovery and timing is the basis for the company's assessment that an LLM agent was driving the execution.
This is not a list of techniques. It is the operating loop Sysdig documented: observe a failure, diagnose it, change the next action and continue toward impact.
Unauthenticated RCE
Credentials, wallets, databases
1,342 Nacos items
No viable recovery key
Reconstructed from Sysdig TRT's July 1 report. The July 20 follow-up documents the later shift toward ENCFORGE and AI infrastructure.
The 31 seconds matter more than the payload count
Six hundred payloads sound dramatic. The 31-second correction tells us more.
A fixed script can run quickly, but it usually repeats the same mistake quickly too. JADEPUFFER changed its approach based on the failure it saw. The same pattern appeared when MinIO returned a different format, when a forged JWT was rejected and when a database drop hit a foreign-key constraint.
This is where the security model changes. A person supervising a console may still be “in the loop” organizationally, but that means little if the agent can observe, decide and perform several irreversible actions before the person understands the first alert.
The response window is no longer defined by human typing speed. In parts of this incident, it was defined by model inference, network latency and database execution time.
The techniques were old
Nothing in the documented chain required a new exploit. It combined an already patched Langflow RCE, default MinIO credentials, old Nacos weaknesses, excessive database privilege and ordinary persistence. That is exactly why the case matters.
Agents make the long tail of known weaknesses cheaper to exercise. They can enumerate more paths, try more combinations and continue after a partial failure without asking an operator to write the next script. Neglected systems did not become newly vulnerable. They became faster to exploit as a sequence.
Langflow also made a valuable entry point because an AI workflow server often sits near the things an attacker wants: provider keys, cloud credentials, databases, object stores and internal APIs. Treating it as a disposable developer tool is a category error. It is privileged infrastructure.
What the case does not prove
JADEPUFFER was not an independent actor that woke up and selected a victim. There was an operator, infrastructure and an objective upstream. Sysdig's follow-up describes the operating model plainly: a human can point an agent at an environment and let the model conduct the technical extortion sequence.
The report also contains details that should make us careful about claims of competence. The encryption key was printed once but never persisted or transmitted, so the victim could not recover the data even after paying. The Bitcoin address in the note was the canonical example address found across Bitcoin documentation. Sysdig could not determine whether the model reproduced it from training data or the operator controlled that exact wallet.
The campaign was adaptive and destructive. It was not infallible. Both facts can be true.
Controls that would have changed the outcome
The victim could not impose policy on the attacker's agent. The enforceable controls lived in the systems the agent reached.
- Remove the entry point. Patch Langflow, do not expose code-execution endpoints to the internet, and inventory public AI workflow services as privileged infrastructure.
- Separate secrets from the web process. Provider keys and cloud credentials should not be broadly available through the environment of an internet-facing orchestrator.
- Limit lateral movement. Network policy and egress controls should stop a compromised workflow host from scanning internal services, reaching database administration ports or beaconing to arbitrary destinations.
- Reduce database authority. Nacos should not connect to its backing database as
root. Administrative accounts need source restrictions, unique credentials and the smallest practical scope. - Detect sequences, not isolated commands. Secret discovery, service enumeration, scheduled persistence, privilege changes and destructive database operations form a much stronger signal together than each event does alone.
Self-narration is another useful signal. Disposable attack payloads normally do not explain why one database has higher “ROI” than another. Natural-language planning inside generated code is not proof by itself, but it is valuable detection and triage context.
What this means for agents we deploy
The offensive agent and an enterprise agent have different goals. Their control problem is still related. Both can chain ordinary tools into an outcome nobody intended to authorize as a whole.
For an agent you operate, policy before execution matters. Destructive database actions, credential reads, network destinations and privilege changes should meet deterministic controls outside the model. Identity and credentials should be scoped to the task. Interruption must be faster than the sequence it is supposed to stop.
I wrote separately about autonomy as a security boundary. JADEPUFFER is field evidence for the core point: the amount of human involvement upstream tells us very little about the speed and authority of the execution loop downstream.
The follow-up arrived quickly
On July 20, Sysdig documented a second JADEPUFFER operation. The same extortion contact appeared in a more mature toolchain. Instead of relying only on improvised Python and database functions, the operator deployed ENCFORGE, a compiled Go ransomware targeting roughly 180 file extensions across model checkpoints, vector databases, datasets and embedding stores.
That evolution took days, not quarters. The first report showed an agent automating database extortion. The second showed the operator turning toward the AI infrastructure itself.
The practical conclusion is direct. Patch the old weaknesses, isolate the systems that orchestrate agents, and enforce authority at every resource they can reach. The era of the agentic threat actor is not a future scenario. It is now a documented operating mode.
Primary sources
- Sysdig TRT, JADEPUFFER: Agentic ransomware for automated database extortion, July 1, 2026
- Sysdig TRT, JADEPUFFER evolves, July 20, 2026
- NIST NVD, CVE-2025-3248
- CISA Known Exploited Vulnerabilities catalog, CVE-2025-3248
Sources and incident status reviewed on July 21, 2026.