{"id":35050,"date":"2026-07-16T22:23:38","date_gmt":"2026-07-16T22:23:38","guid":{"rendered":"https:\/\/www.adminbyrequest.com\/en\/?p=35050"},"modified":"2026-07-20T22:25:42","modified_gmt":"2026-07-20T22:25:42","slug":"jadepuffer-the-first-ransomware-attack-run-entirely-by-ai","status":"publish","type":"post","link":"https:\/\/www.adminbyrequest.com\/en\/blogs\/jadepuffer-the-first-ransomware-attack-run-entirely-by-ai","title":{"rendered":"JadePuffer: The First Ransomware Attack Run Entirely by AI"},"content":{"rendered":"\n

Researchers have documented a ransomware campaign run from start to finish by an AI agent, with no human at the keyboard. Sysdig’s Threat Research Team caught an operator they named JadePuffer breaking into a server, stealing credentials, moving to a second target, and encrypting and destroying a production database. A large language model made the decisions at every stage, in what appears to be the first complete ransomware operation<\/a> driven end-to-end by a model.<\/p>\n\n\n\n

The individual techniques were not novel. A model chaining them into a complete extortion operation on its own is what makes the case notable. It lowers the bar for who can run an attack like this, and it raises the stakes on any unpatched system exposed to the internet.<\/p>\n\n\n\n

How the Attack Worked<\/h2>\n\n\n\n

JadePuffer gained entry through an internet-facing Langflow server. Langflow is an open-source framework for building LLM apps and agent workflows.<\/p>\n\n\n\n

These servers make appealing targets. They tend to sit exposed on the internet, and they often hold API keys and cloud credentials for the services they connect to.<\/p>\n\n\n\n

The entry point was CVE-2025-3248<\/a>, a missing-authentication flaw that lets an unauthenticated attacker run arbitrary Python on the host. It carries a CVSS score of 9.8<\/a>.<\/p>\n\n\n\n

The flaw is not new. A patch shipped in early 2025, and the U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog<\/a> on May 5, 2025. The server JadePuffer compromised had gone unpatched for more than a year.<\/p>\n\n\n\n

Once inside, the agent fingerprinted the host and swept the environment for secrets across several categories at once:<\/p>\n\n\n\n

    \n
  1. LLM provider API keys (OpenAI, Anthropic, Gemini, and others)<\/li>\n\n\n\n
  2. Cloud credentials, with specific coverage of Chinese providers like Alibaba, Tencent, and Huawei, plus AWS, GCP, and Azure<\/li>\n\n\n\n
  3. Cryptocurrency wallets and seed phrases<\/li>\n\n\n\n
  4. Database logins and configuration files<\/li>\n<\/ol>\n\n\n\n

    It then dumped the Langflow server’s own database and pulled credentials from an object store using a default login that had never been changed. Before moving on, it installed a scheduled task to beacon back to attacker infrastructure every 30 minutes.<\/p>\n\n\n\n

    From there it pivoted to its intended target: a separate internet-exposed server running a MySQL database and an Alibaba Nacos configuration service. It forged an admin account and checked whether it could break out of its container.<\/p>\n\n\n\n

    It then encrypted all 1,342 Nacos configuration items, dropped the originals, and left a Bitcoin ransom note behind. The encryption key was generated at random, printed to the screen once, and never saved or transmitted anywhere, which means the victim’s data is unrecoverable even with payment. Whether that was deliberate or a mistake by an autonomous system running without oversight is unclear, but the effect is the same: a destructive operation that paying cannot reverse.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Why AI-Run Is Different From Automated<\/h2>\n\n\n\n

    Ransomware has relied on automation for years. Scripts and toolkits handle the repetitive work. JadePuffer stands apart in how the agent responded when things went wrong.<\/p>\n\n\n\n

    At one point it tried to create a backdoor admin account and the login check failed. Thirty-one seconds later, with no human involved, it identified the likely cause, deleted the broken account, rebuilt it correctly, and logged in. A person reading the error, diagnosing it, writing a fix, and running it would take far longer than half a minute.<\/p>\n\n\n\n

    The pattern repeated throughout the intrusion. When a request returned data in an unexpected format, the next command parsed the new format. When a database operation failed on a technicality, the follow-up applied the correct workaround. Each fix matched the specific failure, which points to diagnosis rather than blind retries.<\/p>\n\n\n\n

    The agent’s code also narrated itself, filled with plain-language notes explaining why each step was happening and which targets were worth prioritizing. Human attackers rarely comment throwaway one-liners this way. LLM-generated code does it by default, and it was part of how researchers identified what they were looking at.<\/p>\n\n\n\n

    What This Means for Everyone Else<\/h2>\n\n\n\n

    The skill required to run an attack like this has dropped. Ransomware once meant having someone in the chain who understood credential theft, lateral movement<\/a>, and persistence well enough to connect them. JadePuffer suggests a model can now supply that expertise. When an agent handles the full sequence, an attacker no longer needs deep knowledge of any single step.<\/p>\n\n\n\n

    Old vulnerabilities also become more dangerous. JadePuffer’s downstream attack relied on a years-old Nacos authentication bypass and a default signing key that shipped unchanged. Agents make it nearly free to throw the entire back catalog of known flaws at a target, so every neglected, internet-facing system becomes a more attractive mark.<\/p>\n\n\n\n

    Closing the Gaps<\/h2>\n\n\n\n

    The defensive measures here are not exotic. Most of them address gaps that are already well understood:<\/p>\n\n\n\n

      \n
    1. Patch known-exploited vulnerabilities quickly, especially anything on the CISA catalog, and keep code-execution endpoints off the open internet.<\/li>\n\n\n\n
    2. Keep API keys and cloud credentials out of the environments of web-facing servers, so a single compromise does not expose everything else.<\/li>\n\n\n\n
    3. Change default credentials and signing keys wherever they ship. JadePuffer’s second stage ran entirely on defaults nobody had touched.<\/li>\n\n\n\n
    4. Restrict administrative database accounts to trusted source IPs and never expose them directly.<\/li>\n\n\n\n
    5. Apply egress controls so a compromised host cannot freely beacon out.<\/li>\n<\/ol>\n\n\n\n

      JadePuffer forged an admin account on the Nacos server and moved through default admin logins nobody had locked down, doing it faster than any human operator could. Permanent admin access is a soft target for an attacker working at that speed.<\/p>\n\n\n\n

      Admin By Request’s Endpoint Privilege Management takes that target off the board. It removes permanent local admin rights on endpoints and grants elevation only when it is needed, for only as long as it is needed, so there is no idle admin access sitting around for an attacker to pick up.<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      Where This Goes Next<\/h2>\n\n\n\n

      JadePuffer is a single documented case, not a wave. The direction is still worth noting. As agentic tooling becomes easier to package and reuse, the first to adopt it will be operators who already know how to connect a model to offensive infrastructure. From there it spreads to less capable attackers.<\/p>\n\n\n\n

      JadePuffer used ordinary tradecraft driven by a model rather than a person. The defenses against it have not changed, but the urgency has, because the systems most organizations keep meaning to patch are now cheaper than ever for an attacker to find and exploit.<\/p>\n\n\n\n

      Ready to close a few of those doors? Book a free demo<\/a> or sign up for our lifetime free plan<\/a>, which gives you the full feature set for up to 25 endpoints, free, for as long as you want.<\/p>\n\n\n\n

      <\/p>\n","protected":false},"excerpt":{"rendered":"

      JadePuffer is the first ransomware attack run end to end by an AI agent, with no human operator. Its entry point was a critical flaw left unpatched for a year.<\/p>\n","protected":false},"author":16,"featured_media":35054,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[580,44,83,148,607],"ppma_author":[428],"class_list":["post-35050","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogs","tag-agentic-ai","tag-ai","tag-cyber-attack","tag-cybersecurity","tag-jadepuffer","entry","has-media"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t