Ransomware Without Hands on the Keyboard: JadePuffer
At 19:34:36 UTC, a login attempt failed. Twelve seconds later, something had already identified the cause and started generating the hash again using a different method. Thirty-one seconds after the failure, a revised payload deleted the broken account and rebuilt it correctly. Eleven seconds later, the login succeeded. Throughout the entire process, no human touched the keyboard.
These actions were part of JadePuffer’s activity, buried deep within MySQL server logs. JadePuffer represents a new form of agentic ransomware, in which a large language model, or LLM, agent independently makes decisions and carries out an entire ransomware attack without human intervention.
Ransomware attacks targeting production databases occur every week. However, JadePuffer stands out because it is the first detailed case in which an LLM agent autonomously executed an entire ransomware operation, from initial access to ransom note creation, without step-by-step instructions from an operator. As the malicious use of AI continues to spread, security professionals need to understand how the JadePuffer attack unfolded in practice.
JadePuffer’s Unremarkable Entry Point
JadePuffer’s initial entry point was not unusual. It exploited CVE-2025-3248, a missing authentication vulnerability in Langflow’s code validation endpoint. The vulnerability allows an unauthenticated attacker to execute arbitrary Python code on the host.
Langflow is an open-source framework for building LLM-based applications. At the time attackers were exploiting the vulnerability, thousands of Langflow instances were exposed directly to the internet without any network controls.
This is a typical example of shadow AI infrastructure. Organizations often deploy these systems quickly for AI pilot projects, only for them to disappear from asset inventories and remain unmanaged.
After gaining access, JadePuffer behaved less like a script and more like an operator following a checklist. First, it performed basic reconnaissance by checking major configuration values and running processes. It then collected credentials through several parallel paths.
Its targets included API keys for LLM providers such as OpenAI, Anthropic, DeepSeek, and Gemini. It also searched for cloud credentials, explicitly including Chinese cloud providers such as Alibaba, Aliyun, Tencent, and Huawei. In addition, JadePuffer looked for database configuration files and cryptocurrency wallets.
Next, it dumped the PostgreSQL instance operating behind Langflow. It also discovered a MinIO object storage bucket that still used default credentials and exfiltrated a JSON file containing valid production access keys. Before moving to the next stage, JadePuffer created a cron job that contacted its command-and-control server every 30 minutes.
This process required no creativity. It required persistence and repetitive execution, and JadePuffer had more than enough of both. During the intrusion, it carried out more than 600 deliberate actions.
From Foothold to the Real Target
The Langflow server was not the final target. It served as a foothold.
Using the credentials it had collected, JadePuffer discovered and moved to a separate internet-facing production server running both MySQL and Alibaba’s Nacos configuration service.
JadePuffer exploited CVE-2021-29441, a known authentication bypass vulnerability in Nacos, to forge a JSON Web Token. It then used the forged token to insert a backdoor administrator account directly into the Nacos database.
One login attempt failed during this process. However, JadePuffer immediately detected the failure, diagnosed its cause, and corrected the problem in less than one minute.
The correction addressed the root cause precisely. Moreover, JadePuffer solved the problem using an entirely different method from its first attempt. It planned, executed, observed the result, and adjusted its approach.
This happened at a speed that would be difficult for both a hands-on attacker and an experienced Security Operations Center, or SOC, analyst to match.
Destruction Without a Recovery Path
Once JadePuffer reached the production database, the operation shifted from intrusion to destruction.
Using built-in MySQL functions, it encrypted all 1,342 Nacos configuration entries. JadePuffer generated the encryption key by combining multiple values. However, it printed the key to standard output, or stdout, only once. It did not save or exfiltrate the key anywhere.
As a result, the victim had no way to restore the data, even after paying the ransom.
It remains unclear whether JadePuffer intentionally designed the attack this way or whether the outcome emerged accidentally from the agent’s operating process. Either way, the impact remained the same.
The destruction then became more explicit. JadePuffer deleted multiple tables and searched through schemas that its own code comments described as “high-ROI databases” for deletion. It identified critical databases by name and specifically targeted them.
When foreign key constraints prevented deletion, JadePuffer immediately tried again using commands that bypassed those restrictions.
The ransom note appeared as a new table named “README_RANSOM.” It contained a Bitcoin address and a contact email address.
The code responsible for these actions also included comments explaining its own behavior. These comments described the reasoning and logic behind its priorities in plain language.
A human attacker would have little reason to create such detailed records for personal reference. An LLM, however, processes and organizes tasks in this way, so it often leaves these explanatory comments behind by default.
Why This Incident Is More Than an Isolated Attack
It would be easy to dismiss JadePuffer as a sophisticated but isolated attack. However, doing so would underestimate the importance of this incident.
The agent performed reconnaissance, credential collection, lateral movement, privilege escalation, and destruction. Throughout the operation, it planned and executed actions while responding to information it gathered in real time.
This pattern does not apply only to Langflow or Nacos. Those services simply happened to be vulnerable within this particular target environment. The same approach can work against any internet-facing service that has a known CVE and provides a path to a database behind it.
Agentic attacks do not necessarily introduce new attack techniques. Security teams already understand many of the methods JadePuffer used.
Instead, agentic ransomware changes the speed of the attack.
Many defensive systems still operate according to human response times. Organizations patch systems over several weeks. Analysts triage alerts during business hours. Incident response plans often assume that an attacker must manually intervene at every stage.
Security teams must now confront attackers that no longer operate at human speed. JadePuffer corrected a failed exploit attempt in 31 seconds. It will not wait for the defense team’s next patching window.
Another important question is where JadePuffer was stopped.
The answer is that it was effectively stopped nowhere.
The controls that should have slowed the attack were either missing or easy to bypass. The perimeter failed at the first point of entry, and there was no meaningful second line of defense between that compromised service and the production database.
Practical Security Priorities
Controls at the perimeter and application layers remain essential. Therefore, patching known CVEs in internet-facing AI infrastructure is still the most direct defensive measure.
This is especially important for tools such as Langflow, which organizations often deploy quickly during AI adoption projects but do not manage as rigorously as core infrastructure.
However, the entire second half of the JadePuffer incident became possible because no effective security layer existed between the compromised perimeter service and the database.
Agentic threats are not a future risk that organizations can address later. JadePuffer is only the first documented case, not the last.
The teams that stay ahead will not simply be the teams that respond fastest to the next attack. Instead, they will be the teams that prepare their final line of defense to protect critical data, even after an agent like JadePuffer crosses the perimeter.
Click here to subscribe our Newsletter
