The First AI Ransomware Attack Was Not Sophisticated. That Is the Point.

On 1 July 2026, Sysdig’s Threat Research Team published their analysis of an operation they named JADEPUFFER. It is worth reading in full. Not because the attack was technically sophisticated, but because it was not, and that is what matters.

The entry point was CVE-2025-3248, a missing-authentication flaw in Langflow, an open-source framework widely used for building AI applications and agent workflows. The vulnerability allows anyone who can reach the server to execute arbitrary Python code on the host without logging in. It carries a CVSS score of 9.8. It was patched in April 2025. CISA added it to the Known Exploited Vulnerabilities catalogue in May 2025. The server that JADEPUFFER hit was never updated.

From that unpatched entry point, an AI agent ran a complete ransomware operation. No human operator was involved at any stage. The agent mapped the compromised Langflow server, swept it for credentials, API keys for AI services including OpenAI, Anthropic, DeepSeek, and Gemini, cloud access material for AWS, Azure, Google Cloud, Alibaba, Tencent, and Huawei, cryptocurrency wallets, and database logins. It dumped Langflow’s PostgreSQL database. It accessed a MinIO object store using the factory default credentials, minioadmin:minioadmin, which had never been changed. When one API request returned XML instead of the expected JSON, the agent adapted its parser in real time and reissued the request. When it hit an error, it corrected itself. Sysdig documented one self-correction that took 31 seconds.

From the Langflow host, the agent pivoted to its real target: a production MySQL database server and an Alibaba Nacos configuration service exposed directly to the internet. It exploited CVE-2021-29441, an authentication bypass in Nacos that creates rogue administrator accounts, a flaw that has been publicly documented since 2021. It encrypted 1,342 Nacos service configuration items using MySQL’s built-in AES encryption function, dropped the original tables, and created an extortion note. The encryption key was generated at random, printed once, and discarded. It was never stored or transmitted, meaning there is no key the attacker could hand over even if payment was made. Recovery requires immutable backups and a tested restoration process. The victim had neither.

Johan Edholm, co-founder of Detectify, described the attack precisely in his response to Dark Reading: none of the individual techniques were novel or sophisticated. Exploiting an exposed service, harvesting credentials, moving laterally, abusing default configurations, and destroying databases are all familiar parts of the playbook. What was new is that an AI model chained them together into a complete operation, without an operator possessing deep expertise in any one step.

That is the shift worth understanding. JADEPUFFER is not a story about a new class of attack technique. It is a story about what happens when an AI agent can take a known vulnerability, a default credential, a misconfigured service, and a forgotten database, and chain them into an outcome without a human making decisions at each step.

The defence argument Sysdig makes is equally precise: JADEPUFFER does not prove that existing controls no longer work. It proves they have become more urgent. The operation did not require an unknown vulnerability. It did not break cryptography. It did not need a sophisticated attacker. It needed an exposed, unpatched Langflow server with credentials sitting in the environment, a MinIO deployment on default credentials, a Nacos service exposed to the internet, and a MySQL database with no egress controls. All of it was familiar. All of it was fixable. None of it was fixed.

I have written before in this series about the last 20% of any remediation programme, the things that were addressed well enough when the crisis was live and then quietly left when the next urgent issue arrived. The Polyfill story illustrated it. An old dependency, a completed response, and then years later the domain came back and started serving fake login prompts to Toshiba and Muji’s customers. JADEPUFFER is the same failure mode in a different context. CVE-2025-3248 was patched. CISA flagged it as actively exploited. And a server ran it unpatched for over a year until an AI agent decided to use it.

The observation that Sysdig and Dark Reading both land on is the one that should concern any IT leader: a quarterly assessment of internet-facing services leaves dangerous gaps when cloud infrastructure changes every day and an automated attacker can move from discovery to impact in minutes. Continuous visibility of the estate is no longer a capability you build toward. It is the minimum foundation.

JADEPUFFER’s payloads were self-narrating. They contained natural language reasoning, target prioritisation, and the kind of detailed annotations that human operators do not often write but LLM-generated code produces reflexively. The AI was not hiding what it was doing. It just did not need to.