Cybersecurity researchers have identified the first documented case of a fully autonomous ransomware operation by AI agents, marking what could become a significant turning point for enterprise cyber resilience.
According to cloud cybersecurity firm Sysdig's Threat Research Team (TRT), an AI-powered threat actor it has named JADEPUFFER conducted an end-to-end ransomware campaign without evidence of direct human intervention during the attack. Rather than relying on a traditional operator manually directing each stage, the campaign used a large language model (LLM) to execute reconnaissance, credential theft, lateral movement, persistence, privilege escalation and ransomware deployment.
The attack exploited CVE-2025-3248, a remote code execution vulnerability affecting Langflow, an open-source framework used to build LLM-powered applications and AI workflows. From an exposed Langflow instance, the agent moved through the victim's environment before targeting a production database server. As Michael Clark, Director of Threat Research at Sysdig, explained in a blog post:
“JADEPUFFER is considered an agentic threat actor (ATA), or an operator whose attack capability is delivered by an AI agent rather than a human-driven toolkit.”
For customer-facing organizations increasingly embedding AI into digital experiences, the incident indicates that AI infrastructure is becoming a new attack surface while attackers themselves are beginning to use AI as an autonomous operator.
An Attack That Adapted in Real Time
Unlike conventional ransomware, which typically follows predefined scripts or requires continuous operator input, JADEPUFFER demonstrated the striking ability to reason through problems and adjust its approach during execution.
“JADEPUFFER's own payloads were self-narrating. They contained natural language reasoning, target prioritization, and the kind of detailed annotations that human operators don’t often write but LLM-generated code produces reflexively,” Clark wrote.
Sysdig researchers observed the AI modifying its own tactics in real time after unsuccessful attempts, diagnosing failures and generating revised payloads within seconds. In one example, after a failed attempt to create an administrative account on a Naming and Configuration Service (Nacos) server, the agent identified the likely cause, regenerated its code and successfully completed the compromise just 31 seconds later.
The campaign also narrated its own decision-making inside its generated Python payloads, explaining why it prioritised specific systems, databases and credentials before carrying out destructive actions.
These characteristics distinguish the campaign from traditional automated tooling, Clark wrote. "The evidence points to an autonomous agent driving the operation rather than a human operator or a fixed toolkit."
AI Infrastructure Becomes the Initial Target
The attack unfolded across two targets—the Internet-facing Langflow instance that allowed initial access and a separate production database server that was its target. It began with an exposed Langflow deployment, highlighting the growing security risks surrounding AI orchestration platforms.
Researchers found the compromised server was systematically searched for:
- LLM provider API keys
- Cloud credentials across AWS, Azure, Google Cloud and major Chinese cloud providers
- Database credentials
- Cryptocurrency wallets
- Configuration files and environment variables
The agent then enumerated internal services, harvested credentials from a MinIO object storage deployment, established persistence via a scheduled beacon and pivoted to its intended production target.
The findings indicate that AI application servers may increasingly become high-value entry points because they frequently contain privileged credentials needed to connect AI models with enterprise systems.
From Compromise to Destruction
After gaining access to a production MySQL server and a Nacos configuration platform, the AI agent demonstrated increasingly sophisticated behavior.
It attempted multiple authentication bypass techniques simultaneously, forged JWT tokens, created administrator accounts directly in the database and conducted systematic privilege escalation checks before launching ransomware.
Rather than encrypting individual files, JADEPUFFER encrypted more than 1,300 Nacos configuration records using MySQL's AES_ENCRYPT() functionality before deleting the original databases and replacing them with an extortion note demanding Bitcoin payment.
Researchers also found the encryption key was generated randomly and never stored or transmitted, making recovery effectively impossible even if a victim chose to pay the ransom.
Why Customer Experience Leaders Should Pay Attention
While the attack focused on infrastructure, its implications extend well beyond cybersecurity teams.
Modern customer experiences increasingly rely on AI-powered applications, digital platforms, API integrations and cloud-native architectures. Many enterprises are rapidly deploying LLM-based assistants, automation tools and orchestration frameworks such as Langflow to improve customer engagement and employee productivity.
Those same platforms may now become preferred entry points for autonomous attackers.
An attack capable of independently compromising customer-facing systems, configuration platforms or cloud infrastructure has the potential to disrupt digital services, expose sensitive customer information and significantly impact brand trust.