For years, cybersecurity experts warned that artificial intelligence would eventually enable malware that could operate without human supervision. In late June 2026, that warning became reality. Security firm Sysdig documented the first known case of fully agentic ransomware — a large language model (LLM) that autonomously infiltrated a production database server, encrypted its contents, and demanded payment, all without a human attacker pressing a single button.
The operation, codenamed JadePuffer by Sysdig's Threat Research Team, represents a fundamental shift in how cyberattacks can be executed. Unlike traditional ransomware, which relies on pre-written scripts, JadePuffer used an LLM as an intelligent agent that could adapt to its environment, make decisions, and chain together multiple exploits on its own.
JadePuffer gained its initial foothold by exploiting CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, an open-source framework used for building LLM-powered applications. Once inside, the AI agent did not follow a fixed playbook. Instead, it mapped the internal network, located credential stores, and extracted login information for the target's Nacos configuration server. From there, it accessed database credentials, connected to a production MySQL server, and began encrypting data while also wiping backups to maximize leverage in ransom negotiations.
What made JadePuffer different from previous automated attacks was its ability to handle unexpected roadblocks. When a command failed or returned an error, the LLM agent adjusted its approach rather than crashing or stopping. Researchers described its behaviour as resembling an experienced human operator working through a target methodically, not a rigid script.
First recorded case of end-to-end agentic ransomware. Unlike earlier AI-assisted attacks where humans still performed critical steps, JadePuffer's LLM agent completed the full kill chain autonomously: initial compromise, lateral movement, credential theft, data encryption, and ransom demand.
Exploited two open-source tools in tandem. The attack leveraged Langflow (CVE-2025-3248) for initial access and Nacos for credential harvesting — both widely deployed open-source platforms. This highlights a growing risk: as AI development tools proliferate, each becomes a potential entry point for AI-driven attackers.
The human role was reduced to providing the objective. The only human input was the high-level goal of "extort money from this target." The LLM agent planned and executed the operation independently, choosing which tools and techniques to use based on what it discovered inside the compromised network.
Security researchers believe JadePuffer is not an anomaly but a preview of a broader trend. As LLMs grow more capable, the cost of launching sophisticated cyberattacks drops dramatically. Organizations that previously worried about human hacking groups now face the prospect of AI agents that can operate around the clock, adapt in real time, and learn from each engagement. Defenders are racing to develop AI-powered detection systems that can recognize the behavioural signatures of agentic attacks — a field that is itself only in its infancy.