Sysdig’s analysis of the JADEPUFFER campaign provides an early, concrete example of agentic ransomware: a large language model directing an extortion operation across reconnaissance, credential harvesting, lateral movement, database destruction, and ransom delivery. Sysdig describes it as the first documented case of its kind (Sysdig, 2026).
The campaign began with CVE-2025-3248, a missing-authentication vulnerability in Langflow, an open-source framework for building AI applications and agent workflows. The flaw enabled remote Python execution on an exposed Langflow server. From there, the agent searched for cloud credentials, database logins, AI-provider API keys and cryptocurrency wallets before moving towards a production database server.
The entry point follows a familiar ransomware pattern. The attack’s significance lies in the agent’s role after access. Sysdig observed payloads containing natural-language explanations of the actions underway, evidence of target prioritization and adaptive responses to failure. In one sequence, the agent diagnosed an error, corrected its code and resumed the operation within 31 seconds.
From Scripts to Tactical Decision-Making
Ransomware operators have used automation for years: malware encrypts files, scripts enumerate systems, and access brokers sell stolen credentials. Human operators usually coordinate the stages that require judgment: deciding where to move next, identifying valuable data, changing tactics after an error, and shaping an extortion demand.
JADEPUFFER moves more of that tactical work into an agentic workflow. The model interpreted the environment, selected credentials of value, generated new payloads, and produced a ransom note containing payment instructions. This reduces the expertise required to operate a campaign and increases the number of attacks a small group can supervise.
Security teams face an attacker that can test more paths, retry failed steps and progress through an environment without waiting for a person at a keyboard. The period between initial compromise and material damage shortens, particularly when cloud credentials or production databases are accessible from the initial foothold.
Agentic ransomware extends the ransomware-as-a-service model by automating part of the affiliate’s operational role. Criminal groups already separate access brokering, malware development, and extortion; an agent can now handle the parts of the work that connect them, including environment discovery, credential triage, and payload execution. The limiting factor changes from the availability of skilled operators to access to a capable agent, an exposed target and a payment channel.
The campaign succeeded because an internet-facing application carried a known vulnerability and provided a route towards valuable credentials and databases.
Organizations using Langflow or similar tools should prioritize three actions:
Sysdig’s report offers one temporary defensive advantage. The agent’s code contained unusually detailed explanations of its logic, creating a detectable pattern across payloads. Attackers can refine their prompts and reduce that verbosity, so defenders should treat it as a current indicator rather than a permanent weakness.
The attacker still entered through an exposed service and a known vulnerability.
Well, the difference came after entry: within 31 seconds, the agent corrected a failed payload and continued towards production systems. That leaves far less time for defenders to spot the intrusion before credentials, databases and cloud services become part of the attack path.
cannot happen quickly.