AI-Driven Ransomware Campaign JadePuffer Operated Without Human Input, Researchers Say

What Sysdig Found

Cloud security firm Sysdig has documented a ransomware campaign, named JadePuffer, that researchers are describing as the first fully agentic ransomware operation on record. The entire attack chain, from initial access to ransom note, was directed by a large language model (LLM) without a human operator guiding each step.

The entry point was CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, an open-source platform used to build agentic AI applications. The attackers' LLM exploited that flaw to get inside a target system, then ran reconnaissance autonomously.

What the AI Did Once Inside

Once the LLM gained access through the Langflow vulnerability, it scanned the environment and harvested a broad set of credentials: LLM-related API keys, cloud service credentials, cryptocurrency wallet data and seed phrases, and database credentials and configuration files, according to Sysdig.

After establishing persistence in the Langflow environment, the campaign pivoted to its actual target: a production server running an Alibaba Nacos configuration service. The LLM then deployed ransomware, encrypted files on that server, and displayed a Bitcoin ransom demand.

That playbook—access, persistence, pivot, encrypt, ransom—is not new. What is new is that every decision in that chain was made by the AI, not a person.

Why Researchers Are Alarmed

Noelle Murata, chief operating officer of Xcape Inc., described JadePuffer as marking "a foundational shift in adversarial capabilities." Her specific concern is the speed differential: LLMs can execute and adapt faster than human defenders can respond.

"By leveraging a large language model to independently navigate the entire cyber kill chain, diagnose its own execution errors, and rewrite payloads in seconds, this operation renders conventional, human-dependent incident response models completely obsolete," Murata said.

The key capability here is adaptation. Traditional ransomware runs a fixed script. If the target environment blocks step three, step three fails and the attack stalls. An LLM-driven attack can recognize the failure, reason about alternatives, and try a different approach, all without a human operator logging in to troubleshoot.

The Strongest Counterargument

JadePuffer still relied entirely on unpatched legacy vulnerabilities and publicly available tools to gain initial access. No zero-days. No novel techniques. CVE-2025-3248 was a known, documented flaw. A target organization running a patched version of Langflow would have stopped this campaign at the door.

Basic patch hygiene would have neutralized the initial access vector. If defenders keep systems updated, the LLM's adaptability never gets a foothold. The attack's sophistication matters far less if the front door is locked.

The problem is that patching discipline across organizations is notoriously inconsistent, and the speed advantage the LLM holds does not require a novel entry point. It just requires one unpatched system, and then it works faster than the humans trying to stop it.

The Real Operational Change

The distinction Murata draws between "scripted and rigid" attacks and "autonomous, machine-speed execution" captures the core of the security concern. Ransomware groups have historically needed skilled operators who could manually adapt a campaign when defenses pushed back. That created a ceiling on how many simultaneous attacks a criminal group could run and how fast those attacks could move.

An LLM removes that ceiling. One operator could theoretically supervise dozens of simultaneous autonomous campaigns, each one adapting independently to whatever defenses it encounters. The human bottleneck in ransomware operations disappears.

Sysdig notes that AI errors and hallucinations could undermine a campaign's effectiveness. An LLM can misread an environment, try a wrong approach, or generate a broken payload. That is a real limiting factor. It is a probabilistic limit, not a structural one, and the speed of iteration means the model can recover from errors faster than defenders can capitalize on them.

What Needs to Happen Now

CVE-2025-3248 in Langflow should have been patched by any organization using the platform. That is critical. Sysdig's findings also raise a harder question for the security industry: incident response playbooks built around human attacker timelines may need to be rebuilt from scratch if LLM-driven campaigns can compress the full kill chain into minutes rather than hours or days.

Whether JadePuffer represents a one-off experiment by a sophisticated threat actor or the early template for a broader shift in ransomware operations is the unresolved question. Sysdig's documentation is the first detailed public accounting of this attack pattern, and how quickly other criminal groups replicate it will determine how fast defenders have to adapt.