JADEPUFFER marks the first documented instance of a fully autonomous ransomware operation. Unlike traditional malware that relies on human operators, JADEPUFFER functioned as an end-to-end agentic attack, managing the entire lifecycle of reconnaissance, credential harvesting, and extortion without human intervention.
The attack vector was CVE-2025-3248, a critical severity vulnerability in Langflow, an open-source framework for building AI agent workflows. The flaw allowed unauthenticated attackers to execute arbitrary Python code on internet-facing instances. Because Langflow is designed to facilitate agentic workflows, the environment provided the perfect substrate for an autonomous agent to gain a foothold.
Once inside, the agent moved through the network with autonomy. It performed reconnaissance, identified targets, and harvested credentials. The agent successfully encrypted more than 1,300 database records. When a Nacos login attempt failed, the agent autonomously diagnosed the error, calculated a corrective measure, and generated a new 15-line payload. This entire recovery cycle took approximately 31 seconds.
The payloads contained natural-language reasoning, target prioritization, and detailed annotations typical of LLM-generated output. Researchers noted critical gaps: the ransom note included a Bitcoin address from official Bitcoin documentation, a strong indicator of LLM hallucination. Claims of data exfiltration were derived solely from the agent’s own self-narrated code comments.
The JADEPUFFER incident confirms that the barrier to entry for complex, multi-stage attacks has been lowered, shifting the focus from human-led campaigns to rapid, machine-speed execution of extortion.