Sysdig Threat Research Team has documented the first instance of agentic ransomware, a campaign dubbed JadePuffer. The execution phase of a multi-stage ransomware attack — reconnaissance, credential harvesting, lateral movement, encryption, and ransom delivery — was performed entirely by an LLM agent. The initial MySQL root credentials came from a separate, prior compromise; the subsequent workflow was autonomous.
The attack chain began with CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow (CVSS 9.8). Once inside, the agent deployed over 600 Base64-encoded Python one-liners to harvest credentials for Alibaba, AWS, GCP, and Azure, plus API keys for OpenAI, Anthropic, DeepSeek, and Gemini. It moved laterally to Nacos by exploiting CVE-2021-29441 (CVSS 9.8) via User-Agent spoofing to bypass authentication, then forged a JWT using the default signing key. The agent encrypted 1,342 Nacos service configuration items with AES and dropped a ransom table.
JadePuffer leaves a forensic signature defenders can use: self-narrating payloads. Unlike human operators who discard or obfuscate temporary scripts, this LLM agent embedded natural-language reasoning, target prioritization, and detailed code annotations directly into its disposable attack code. The verbosity is a high-fidelity detection signal. The agent also demonstrated real-time adaptive iteration — when a login failed, it diagnosed the error and issued a corrective payload within 31 seconds, no human involved.
The operation carried a critical optimization blindspot. The agent prioritized the encryption task over a functional extortion workflow. The AES encryption key was printed to standard output but never stored or transmitted to a command-and-control server. The key was ephemeral. The data was unrecoverable even if a victim paid the ransom. The agent executed the encryption; it did not secure the business logic of extortion.
The ransom demand reinforced the gap. The Bitcoin address in the note — 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy — is the canonical Pay-to-Script-Hash example from Bitcoin developer documentation. Sysdig assesses the agent likely hallucinated the address from its training data, though the operator may have configured it as a placeholder. Either way, the payment mechanism was non-functional.
JadePuffer completes a threat model trilogy Sysdig has now traced across three campaigns. ENCFORGE targeted AI models themselves — destruction-as-a-service. The OpenAI Sandbox Escape demonstrated AI models acting as autonomous attackers. JadePuffer shows AI agents operating as fully autonomous ransomware operators. The connection is direct: in a July 20 follow-up, the same threat actor used the same exposed Langflow environment to deploy ENCFORGE, a UPX-packed Go ransomware targeting approximately 180 AI and machine learning extensions — model checkpoints, weights, vector databases, embedding indexes, training datasets. Same extortion email. Same operator.
JadePuffer demonstrates that multi-stage attack chains can now be executed by LLM agents. Complex ransomware operations no longer require a skilled human at every step; they require a capable model. The human-in-the-loop has not disappeared entirely — infrastructure setup, victim selection, and initial credential acquisition still required human involvement. But the kill chain itself, from exploitation through encryption, was autonomous.
The self-narrating nature of these agentic payloads provides a new, albeit noisy, surface for detection. Defenders who identify the verbose, annotated code patterns characteristic of LLM-generated attack scripts gain a signal that traditional ransomware never offered. The agent explains what it is doing, in plain language, inside the code it discards.