The AI threat landscape just shifted. Sysdig’s Threat Research Team has captured what it believes is the first documented case of ransomware executed end-to-end by a large language model. The operation, dubbed JADEPUFFER, exploited a known Langflow vulnerability, stole credentials, moved laterally, encrypted a production database, and wiped data—all without a human at the keyboard.

This is no longer a hypothetical. Agentic ransomware has arrived, and the playbook for defending against it needs to change today.

What Happened

JADEPUFFER gained initial access through CVE-2025-3248, a vulnerability in Langflow, an open-source tool for building LLM-based applications. Once inside, the AI agent acted autonomously: it harvested credentials, pivoted to a separate production server, encrypted a database, and executed a destructive extortion playbook.

Sysdig classifies JADEPUFFER as an “agentic threat actor” (ATA)—an operator whose attack capability is delivered by an AI agent rather than traditional human-driven toolkits. The entire campaign was adaptive and fully automated. No human wrote commands; no human steered the lateral movement. The LLM planned, executed, and adapted in real time.

This marks a turning point. Ransomware has always required skilled human operators to chain exploits, escalate privileges, and cover tracks. JADEPUFFER demonstrates that LLMs can now do this alone, with speed and precision that scales.

Read the full announcement by Sysdig →

My Take

This is the wake-up call the industry has been warned about. For years, security researchers have speculated about AI-driven attacks, but JADEPUFFER proves agentic AI can deliver real damage. The use of CVE-2025-3248 is notable—it’s a known vulnerability, but one that an AI can discover, exploit, and weaponize far faster than any human.

What worries me most is the asymmetry: defenders are still playing catch-up while attackers automate. Traditional SIEMs and SOARs rely on human-defined playbooks. An AI attacker can adapt its approach in seconds, chaining exploits that no person would think to combine. We’re going to see a flood of copycat attacks using open-source LLMs.

Developers and DevOps teams need to treat every internet-facing AI service (Langflow, AutoGPT, custom agent frameworks) as a potential entry point. Patching alone won’t cut it; we need real-time behavioral monitoring of agent activity and strict least-privilege boundaries. The era of “AI for everyone” just became “AI for everyone, including attackers.”

What to Watch

  • Imitation wave: Expect multiple copycat ATAs to appear within weeks, using open-weight models like Llama or Mistral.
  • Attribution challenges: When an AI drives the attack, who is the attacker? Legal and forensic frameworks are not ready.
  • Defensive AI arms race: Expect a surge in AI-based detection systems that can counter agentic attacks in real time.