An LLM agent likely drove a ransomware intrusion that encrypted 1,342 Nacos configuration items, Sysdig assesses
An intrusion Sysdig calls JADEPUFFER entered through Langflow vulnerability CVE-2025-3248 and ended with all 1,342 Nacos configuration items on a production server encrypted with a key that was never saved. Sysdig assesses that an autonomous LLM agent ran the operation.
An attacker got into an internet-facing Langflow instance through CVE-2025-3248, a missing-authentication flaw in its code validation endpoint, then reached a separate internet-exposed production server running MySQL and Alibaba Nacos1. There it encrypted all 1,342 Nacos service configuration items with MySQL's AES_ENCRYPT(), dropped the original config_info and history tables, and left a note reading "YOUR DATA HAS BEEN ENCRYPTED." with a Bitcoin address and a Proton Mail contact1.
Sysdig, which published its analysis on July 1, 2026, assesses that "the evidence points to an autonomous agent driving the operation rather than a human operator or a fixed toolkit." The payloads narrate each action in natural language, and failures were fixed fast: the gap between a failed login and "the correct multi-step fix is 31 seconds." Sysdig calls it "what we assess to be the first documented case of agentic ransomware," though it has "no visibility into JADEPUFFER's system prompt or agent configuration" and doesn't name a model12.
The AES key was "never persisted or transmitted," so "the victim cannot recover the encrypted configurations even with payment." The note's claim of data theft "is the agent's own assertion" and is unverified, and the Bitcoin address is the canonical example from Bitcoin developer documentation1. "Mass data destruction appears to have been the aim"2.
Sysdig's Threat Research Team published its analysis of the JADEPUFFER intrusion on July 1, 2026.
“July 1, 2026”
Sysdig describes JADEPUFFER as what it assesses to be the first documented case of agentic ransomware.
“what we assess to be the first documented case of agentic ransomware”
According to Sysdig, the attacker gained initial access to an internet-facing Langflow instance through CVE-2025-3248, a missing-authentication flaw in Langflow's code validation endpoint.
“gained initial access to an internet-facing Langflow instance through CVE-2025-3248”
Sysdig reports that the attacker reached a separate internet-exposed production server running a MySQL database and an Alibaba Nacos configuration service.
“a separate internet-exposed production server running a MySQL database and an Alibaba Nacos configuration service.”
Sysdig reports that the attacker encrypted all 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT() function and dropped the original config_info and history tables.
“encrypting all 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT()”
Sysdig reports that the attacker left a ransom note beginning "YOUR DATA HAS BEEN ENCRYPTED." that contained a Bitcoin payment address and a Proton Mail contact. A later version of the note read "All 1342 configuration items have been encrypted."
“containing the demand, a Bitcoin payment address, and a Proton Mail contact”
Sysdig assesses, from four lines of evidence, that an autonomous LLM agent drove the operation rather than a human operator or a fixed toolkit. The evidence includes self-narrating payloads and rapid diagnosis and correction of failures.
“the evidence points to an autonomous agent driving the operation rather than a human operator or a fixed toolkit”
Sysdig says that after a failed login, a corrective multi-step payload was issued 31 seconds later without human intervention.
“The window between the failed login and the correct multi-step fix is 31 seconds.”
Sysdig says it has no visibility into the actor's system prompt or agent configuration and does not name the model used.
“because we have no visibility into JADEPUFFER's system prompt or agent configuration”
According to Sysdig, the AES key was never persisted or transmitted, so the victim cannot recover the encrypted configurations even by paying.
“The victim cannot recover the encrypted configurations even with payment”
Sysdig says the ransom note's claim of data exfiltration is the agent's own assertion and was not independently verified.
“The exfiltration claim is the agent's own assertion”
Sysdig notes that the Bitcoin address in the note is the canonical Pay-to-Script-Hash example from Bitcoin developer documentation, and that it may have been hallucinated by the LLM or deliberately configured by the operator.
“is the canonical Pay-to-Script-Hash format example embedded across Bitcoin developer documentation”
Infosecurity Magazine attributes the "first" agentic ransomware claim to Sysdig and writes that mass data destruction appears to have been the aim.
“Mass data destruction appears to have been the aim”
Measurements
All 13 claims with their quotes
- Sysdig's Threat Research Team published its analysis of the JADEPUFFER intrusion on July 1, 2026.1
“July 1, 2026”
- Sysdig describes JADEPUFFER as what it assesses to be the first documented case of agentic ransomware.1
“what we assess to be the first documented case of agentic ransomware”
- According to Sysdig, the attacker gained initial access to an internet-facing Langflow instance through CVE-2025-3248, a missing-authentication flaw in Langflow's code validation endpoint.12
“gained initial access to an internet-facing Langflow instance through CVE-2025-3248”
- Sysdig reports that the attacker reached a separate internet-exposed production server running a MySQL database and an Alibaba Nacos configuration service.1
“a separate internet-exposed production server running a MySQL database and an Alibaba Nacos configuration service.”
- Sysdig reports that the attacker encrypted all 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT() function and dropped the original config_info and history tables.12
“encrypting all 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT()”
- Sysdig reports that the attacker left a ransom note beginning "YOUR DATA HAS BEEN ENCRYPTED." that contained a Bitcoin payment address and a Proton Mail contact. A later version of the note read "All 1342 configuration items have been encrypted."1
“containing the demand, a Bitcoin payment address, and a Proton Mail contact”
- Sysdig assesses, from four lines of evidence, that an autonomous LLM agent drove the operation rather than a human operator or a fixed toolkit. The evidence includes self-narrating payloads and rapid diagnosis and correction of failures.1
“the evidence points to an autonomous agent driving the operation rather than a human operator or a fixed toolkit”
- Sysdig says that after a failed login, a corrective multi-step payload was issued 31 seconds later without human intervention.12
“The window between the failed login and the correct multi-step fix is 31 seconds.”
- Sysdig says it has no visibility into the actor's system prompt or agent configuration and does not name the model used.1
“because we have no visibility into JADEPUFFER's system prompt or agent configuration”
- According to Sysdig, the AES key was never persisted or transmitted, so the victim cannot recover the encrypted configurations even by paying.12
“The victim cannot recover the encrypted configurations even with payment”
- Sysdig says the ransom note's claim of data exfiltration is the agent's own assertion and was not independently verified.12
“The exfiltration claim is the agent's own assertion”
- Sysdig notes that the Bitcoin address in the note is the canonical Pay-to-Script-Hash example from Bitcoin developer documentation, and that it may have been hallucinated by the LLM or deliberately configured by the operator.1
“is the canonical Pay-to-Script-Hash format example embedded across Bitcoin developer documentation”
- Infosecurity Magazine attributes the "first" agentic ransomware claim to Sysdig and writes that mass data destruction appears to have been the aim.2
“Mass data destruction appears to have been the aim”
Sources
- [1]JADEPUFFER: Agentic ransomware for automated database extortion
- [2]Researchers Claim First Fully Agentic Ransomware: JadePuffer
Editor notes
Single-vendor account. The assessment that an LLM agent was autonomous comes only from Sysdig, and the model and agent framework are not identified. The intrusion date is not given (Sysdig shows only UTC times), so the date is the month of the first report. The victim is unnamed. Sysdig is listed as both researcher and reporter. Infosecurity Magazine's quote of Sysdig ("31 second") differs slightly from the blog's wording. The claims use the blog's text.