An AI Ran a Full Ransomware Attack, Then Forgot the Data

Sysdig's threat researchers say they've watched a ransomware attack run from start to finish by a large language model, with no human at the keyboard. They've called the agent JadePuffer, and it walked in through CVE-2025-3248, a missing-authentication flaw in Langflow that lets anyone on the internet execute Python on the host.

The tell was the writing. The payloads narrated themselves, complete with reasoning, target prioritisation, and the sort of chatty comments no self-respecting human operator would leave behind. When something failed, the agent adjusted and tried again. In one attempt, it went from a broken login to a working exploit in 31 seconds.

What it did once inside

The agent went hunting for anything portable and valuable:

• LLM API keys
• Cloud credentials across AWS, Azure, GCP and the major Chinese providers
• Crypto wallets
• Database logins

It set a crontab to phone home every 30 minutes, then pivoted to an exposed MySQL instance and an Alibaba Nacos server. From there it chained an authorisation bypass (CVE-2021-29441) with a forged JWT signed using Nacos's default signing key, and encrypted all 1,342 Nacos configuration items using MySQL's built-in AES function. It left a ransom note, a Bitcoin address, and a Proton Mail contact.

The punchline

Sysdig reckons the victim couldn't recover their data even if they wanted to pay. The agent escalated from deleting rows to dropping entire schemas, narrating why as it went, and never bothered to keep a copy of what it was encrypting. That is extortion without the leverage. A ransom note for files that no longer exist in any form.

None of the individual techniques were particularly clever. What matters is that an LLM stitched them together into a working operation against neglected, internet-facing kit. As Sysdig's Michael Clark put it, the skill floor for running ransomware is now roughly the cost of running an agent. And if the agent is running on hijacked API keys, that cost is effectively zero.

Worth a look this week

The obvious question for anyone running infrastructure: what admin endpoints are quietly exposed to the open internet? Langflow, Nacos, MySQL, anything with a management interface, anything with a default credential still in place. Automated agents don't sleep, don't get bored, and don't miss the ones you forgot about.

There is also something faintly comic about the whole episode. A machine walked through a full ransomware playbook, executed it competently enough to encrypt everything in sight, then failed at the one step a human would never skip: keeping the hostage alive. It's a useful reminder that the current generation of autonomous attackers is capable, prolific, and not yet especially careful.