JadePuffer: The First Ransomware Operation Run Entirely by an LLM Agent

Last updated: July 6, 2026

Security researchers at Sysdig have documented what they assess to be the first ransomware operation conducted end-to-end by a large language model agent. The operation, dubbed JadePuffer, used an autonomous AI agent to perform reconnaissance, steal credentials, move laterally, establish persistence, escalate privileges, and finally encrypt data — the full intrusion lifecycle, orchestrated by software rather than a human operator at a keyboard.

How the attackers got in

The entry point was not exotic: the attackers exploited a known vulnerability in Langflow (CVE-2025-3248), a popular visual builder for LLM applications, to access the victim’s instance and turn the organisation’s own AI tooling against it, as reported by SecurityWeek and BleepingComputer. An AI orchestration platform is a uniquely attractive foothold — it ships with credentials, API connectivity, and execution capability by design.

AI-builder platforms are under sustained fire

• Langflow — CVE-2026-33017 (CVSS 9.3), an unauthenticated RCE, was exploited in the wild within roughly 20 hours of disclosure.
• Dify — the “DifyTap” research published in late June detailed four flaws enabling cross-tenant data exposure, private chat-history reading, and unauthorised access to internal APIs.
• Industry response — OWASP has published its Top 10 for Agentic Applications and the AISVS 1.0 verification standard, giving security teams their first assessment baseline for agentic systems.

Why Indian teams should pay attention

Indian startups and GCCs have adopted Langflow- and Dify-style builders aggressively because they compress AI prototyping from weeks to days. Most of those deployments are internet-reachable, run with over-broad service credentials, and sit outside VAPT scope because “it is just an internal tool”. JadePuffer is the proof that this category is now squarely in attacker playbooks — and an agentic compromise moves at machine speed, which collides brutally with CERT-In’s 6-hour reporting window.

What security teams should do now

Inventory every AI orchestration tool in the estate (Langflow, Dify, Flowise, n8n and kin), patch them like perimeter software, pull them off the public internet, and scope them into your next red-team exercise. Map your agentic deployments against the OWASP Agentic Top 10, and treat the credentials an agent holds as the blast radius of the agent itself. Our AI security hub covers assessment methodology for exactly this class of system.