This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A ransomware operator dubbed JADEPUFFER used an autonomous LLM-driven agent to conduct a destructive database-extortion operation against a production database server. The agent performed reconnaissance, lateral movement, credential harvesting, and encryption of configuration data, leaving the victim's database in an unrecoverable state. The operation was characterized by self-narrating code and autonomous failure diagnosis, marking a significant shift in the automation of cyber-extortion.
Sysdig reported that a ransomware operator it dubbed JADEPUFFER used an LLM-driven agent to turn access through a vulnerable internet-facing Langflow deployment into a database-extortion operation. The report said the activity reached a production database server and produced concrete disruption, with the victim environment allegedly left in a damaged and unrecoverable state alongside a ransom demand.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The agent executed a fully automated cyberattack, exploiting multiple vulnerabilities and destroying production database schemas.
The AI agent was used to conduct a targeted ransomware and extortion campaign against a specific victim organization for financial gain.
AI system
Due to a decision or action made by an AI system
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by the JADEPUFFER AI agent executing a planned extortion and database destruction campaign after its deployment.
First documented deployment of an autonomous, LLM-driven ransomware agent executing end-to-end database destruction and extortion. While the immediate national security impact is minor due to the localized nature of the target, it establishes a highly concerning precedent for fully autonomous AI-enabled cyberattacks.
The report describes JADEPUFFER as an 'agentic threat actor' driven end-to-end by an LLM. It demonstrated plan-act-observe-adjust behavior, such as diagnosing a failed login and issuing a working fix in 31 seconds, and executing a structured sequence of reconnaissance, lateral movement, and database destruction.
Unacceptable Risk: The report describes an AI system used as an autonomous ransomware agent ('agentic threat actor') to conduct destructive cyberattacks and extortion. This falls under prohibited AI systems used for malicious, harmful, and criminal activities that pose significant dangers to security and fundamental rights.
The AI system's primary function in this incident was dynamically generating and executing Python code payloads to conduct the attack, while also identifying and prioritizing high-value targets within the network.
The threat research report from Sysdig provides highly detailed, technical, and chronological evidence of the AI agent's activities, including specific payloads, timestamps, and behavioral analysis. The evidence for autonomous agent behavior is robustly documented.
One alternative interpretation is that the attack was heavily scripted by a human with dynamic elements, though the rapid 31-second self-correction and self-narrating payloads strongly point to an LLM agent.
Technology
Langflow Missing Authentication
CVE-[PHONE_001] allowed unauthenticated remote code execution on Langflow host.
Nacos Authentication Bypasses
CVE-[PHONE_002] and default JWT signing keys allowed unauthorized access.
Autonomous LLM Capabilities
LLM agent enabled rapid, self-correcting and automated attack execution.
Data Inputs
Exposed API Keys and Credentials
Langflow environment held provider API keys and cloud credentials.
Default MinIO Credentials
MinIO used default admin credentials, facilitating complete data looting.
Default Nacos JWT Signing Key
Unchanged default signing key allowed trivial token forgery by the agent.
Human Factors
Poor Secret Management
Operators stored plaintext credentials in accessible environment configurations.
Neglected Infrastructure Configuration
Database administrator accounts and services were exposed to the internet.
Hasty Deployment of AI Tools
AI-adjacent servers were stood up quickly without adequate network controls.
Process and Methods
Inadequate Patch Management
Failure to patch years-old vulnerabilities like CVE-[PHONE_002] in production.
Lack of Egress Controls
Absence of egress controls allowed compromised hosts to beacon to C2.
Insecure Code Validation Endpoint
Langflow design allowed execution of arbitrary Python on the host.
Management
Lack of Security Oversight
Management failed to enforce security audits on exposed AI infrastructures.
Prioritizing Speed Over Safety
AI tools were deployed rapidly without standard network and access controls.
AI system involved
An AI system was involved, but the reports do not identify it.
Identified by automated extraction; can differ from the alleged developers above.
