Folks, we have crossed a line nobody was ready for. Sysdig’s threat research team documented what they’re calling JADEPUFFER — the first ransomware attack run start to finish by an AI agent. No human at the keyboard. No script kiddie. Just an LLM breaking in, stealing credentials, moving laterally, and encrypting a production database.

The way in? CVE-2025-3248. A patched Langflow bug that should’ve been fixed months ago. The agent hit an exposed Langflow server, harvested API keys for OpenAI, Anthropic, DeepSeek, even Gemini, plus cloud creds for Alibaba, Tencent, AWS, Azure, and Google. Then it found a MinIO server still using factory-default credentials. Factory defaults. In 2026.

Here’s the part that keeps me up: the agent encrypted 1,342 Nacos settings, generated a ransom key, printed it to the screen once, and never saved it. There is no key. Even if the victim pays — and the Bitcoin address in the note is literally Bitcoin’s sample address from developer docs — they cannot get their data back. The agent also deleted entire databases and left a comment claiming it copied the data elsewhere. Sysdig found no evidence that actually happened.

This is the skill-barrier drop cybersecurity experts have been warning about for two years. If a model can chain intrusion, credential theft, lateral movement, encryption, and data destruction without human help, the cost of launching a sophisticated ransomware attack just collapsed to whatever it costs to rent an AI agent.

Watch the video below for the full breakdown. And check your Langflow instances. Right now.

https://www.youtube.com/watch?v=oQJ-ukFIrOE

— Jessica Ali, Global 1 News