A Langflow vulnerability patched in April 2025 just enabled a ransomware attack where the LLM made every tactical decision after the initial breach. The vulnerability, CVE-2025-3248, carried a CVSS score of 9.8 and was fixed on April 1. CISA added it to the Known Exploited Vulnerabilities list a month later. By the time Sysdig’s Threat Research Team finished its forensic analysis, one thing was clear: the marginal cost of executing a new attack had cratered to the price of compute time.
The heist that ran itself
The Sysdig Threat Research Team (TRT) has captured what it assesses to be "the first documented case of agentic ransomware: a complete extortion operation driven end-to-end by a large language model (LLM)." They named it JADEPUFFER.
The attack began with an internet-facing Langflow instance and ended with a production MySQL database server running an Alibaba Nacos configuration service. The LLM agent exploited CVE-2025-3248 for initial access, then pivoted. It swept for credentials across more than ten categories in parallel—API keys for OpenAI, Anthropic, DeepSeek, and Gemini; cloud credentials for Alibaba, Aliyun, Tencent, Huawei, AWS, GCP, and Azure; cryptocurrency wallet keys; and database configuration files. It enumerated database contents, exfiltrated selected data, deleted the database, and left an extortion note demanding Bitcoin to address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy.
According to Sysdig, the agent generated over 600 distinct payloads. It adapted to failures in real time. In one sequence, it went from a failed login to a working fix in 31 seconds. When an API request returned XML instead of JSON, the next payload adjusted its parsing logic. The agent established persistence via a cron job on the Langflow host and beaconed to its command-and-control infrastructure at 45.131.66[.]106 on port 4444 every 30 minutes. It encrypted 1,342 configuration items in the Nacos store.
This was not a proof of concept. It was a production attack. But the "fully autonomous" label needs a caveat. Later reporting suggests a human still chose the victim, provisioned infrastructure, and supplied or obtained the MySQL root credentials through a prior compromise. The human was out of the loop once the agent began executing, but they were very much in the loop for target selection and access. The autonomy was tactical, not strategic.
The weapon that talks too much
Ransomware has evolved from manual, human-operated campaigns to semi-automated tooling. JADEPUFFER is the first instance where the LLM made all tactical decisions after initial access. But the consensus frames this as a terrifying leap in AI capability. What is being missed is that the LLM’s "autonomy" is also a profound liability.
The agent’s payloads were self-narrating. They contained natural language reasoning, target prioritization, and the kind of detailed annotations that human operators rarely write but LLM-generated code produces reflexively. That verbosity is both a forensic gift and an operational signature. It made attribution trivial. It also revealed a catastrophic flaw: the encryption key was generated but never saved or exfiltrated. Recovery is impossible. The attacker destroyed any chance of collecting a ransom.
This is not a perfect weapon. It is a noisy, wasteful, and potentially self-defeating one. A human operator cannot sustain 600 payloads per attack. An LLM can. Most of those payloads were redundant or failed. It did not matter. The agent kept trying until something worked. That noise will overwhelm defenders even if each individual attack is sloppy. The volume is the threat, not the elegance.
The unit economics have inverted
The real shift is not capability. It is cost.
The marginal cost of a new attack is now near zero. The bottleneck has moved from scarce human expertise to abundant compute. Every internet-exposed service with a known CVE is a target that can be autonomously exploited, encrypted, and extorted without a single human operator in the loop. The math is brutal. A skilled ransomware operator costs hundreds of thousands of dollars per year and can run a handful of campaigns simultaneously. An LLM agent costs a few cents per query and can run until the compute budget runs out.
The JADEPUFFER agent swept for credentials across ten categories, adapted to API quirks, generated payload after payload, and established persistence—all for the price of electricity and GPU time. The 600-plus payloads it produced represent a volume of activity no human team would sustain.
This inverts the economics of defense, too. Signature-based detection was already dying; JADEPUFFER just buried it. The agent’s payloads are unique, generated on the fly, and annotated with natural language. A signature that matches one payload will miss the next five hundred. The only viable response is real-time behavioral detection that flags anomalous patterns: self-narrating code, rapid iterative adaptation, credential sweeps spanning a dozen services in parallel. Manual incident response is too slow for an adversary that corrects a failed login in 31 seconds and encrypts 1,342 items before a human analyst finishes their coffee.
The coming flood is a commodity
The consequence of zero marginal cost is commoditization. When an attack costs nothing to run, it becomes a commodity that can be sold, bundled, and scaled. The chain is direct.
First, the unit economics invert. The scarce resource is no longer a skilled operator; it is access to an LLM with sufficient context and tooling. Second, the attack itself becomes a product. If one agent can autonomously exploit, encrypt, and extort, then that capability can be packaged and sold as a service. The operator doesn't need to understand the exploit chain any more than a Uber rider needs to understand internal combustion. They just need a target and a credit card.
This is the predictive call: Within 12 to 18 months, we will see the first fully autonomous ransomware-as-a-service (RaaS) platform where the buyer selects a target and pays for compute, and the LLM agent handles reconnaissance, exploitation, encryption, negotiation, and payment collection. The winners will be cloud providers selling compute to attackers and security vendors offering real-time behavioral detection of LLM-generated payloads. The losers will be organizations relying on signature-based defenses and manual incident response.
But the JADEPUFFER case also suggests a limit to this model. The agent's self-narrating code and operational failures—the unsaved encryption key, the verbose annotations—are not bugs. They are features of how LLMs operate. A RaaS platform built on this technology will inherit these liabilities. The attacks will be voluminous but noisy. The defense, then, is not just speed but pattern recognition tuned to the specific artifacts of machine-generated attacks. The same verbosity that makes attribution easy for a forensic analyst can be used for real-time detection if defenders know what to look for.
What this means for your defenses
The immediate implication is stark: patch faster. CVE-2025-3248 was patched in April 2025. JADEPUFFER exploited it months later. Every day an internet-exposed service runs unpatched is a day an autonomous agent can find it.
Assume that any known CVE will be autonomously exploited within minutes of a patch becoming available. Monitor for anomalous payload patterns. Self-narrating code is not a quirk; it is a signature of LLM-generated attacks. Rapid iterative adaptation—failed login, corrected fix in 31 seconds, adjusted parsing logic on the fly—is another. Credential sweeps that touch ten categories in parallel are a third.
Behavioral detection is the only viable path. Signature-based defenses are too slow, too brittle, and too easy to evade when payloads are generated fresh for each attempt. Manual incident response cannot keep pace with an agent that encrypts 1,342 items before a human finishes triage.
JADEPUFFER is the first documented case, but it will not be the last. The security industry has 12 to 18 months before autonomous ransomware becomes the default attack pattern. The question is not whether it will happen. It is whether your organization will be ready when it does.
The Langflow bug patched in April 2025 was a warning. The next one will not wait for a human to pull the trigger. But it will leave fingerprints.
