JADEPUFFER Compresses a Ransomware Intrusion into Minutes
Sysdig describes JADEPUFFER as the first documented end-to-end agentic ransomware operation. Its speed changes how defenders should think about containment and AI infrastructure exposure.
Sysdig reported an operation it calls JADEPUFFER on 1 July. The attacker exploited an internet-facing Langflow vulnerability, CVE-2025-3248, and deployed an AI-driven system that performed reconnaissance, discovered credentials, moved towards production data and attempted extortion.
According to the research, the system adjusted after a failed action in about 31 seconds and generated payloads that narrated their own progress. Sysdig characterised the incident as the first documented end-to-end ransomware operation in which a large language model drove the attack chain. That is a research assessment based on the observed case, not proof that every later step occurred without any human involvement.
Speed removes comfortable gaps
Traditional incident playbooks often assume a progression measured in hours or days: initial access, discovery, credential theft, lateral movement and impact. An agent can run commands, interpret output and choose another path continuously.
This makes preventive boundaries and automatic containment more important. An alert that waits in a queue for an analyst may arrive after the attacker has already tested several alternatives.
AI tooling is production infrastructure
Langflow and similar orchestration tools can execute components, store provider credentials and connect to databases or cloud services. A visually simple development interface may therefore have the privileges of an automation server.
Defenders should:
- remove AI workflow tools from direct internet exposure;
- patch CVE-2025-3248 and verify the running version;
- place access behind strong authentication and a managed gateway;
- store only narrowly scoped, short-lived credentials;
- restrict outbound connections and cloud metadata access;
- separate experimentation from production networks and data;
- alert on unusual child processes, secret discovery and rapid command sequences.
Search the external attack surface for forgotten test deployments. A proof of concept created by one team can still hold live credentials.
Build machine-speed circuit breakers
Detection rules should be able to suspend a workload identity, isolate a container or block an egress path when confidence is high. Those actions need safety limits, audit logs and rapid human review, but the initial containment may need to happen automatically.
Rate limits and privilege boundaries also matter. An application identity that can enumerate every secret and delete every database gives any attacker—human or agent—the same power.
Exercise the response with compressed time. Can the organisation identify the compromised workload, revoke its tokens and prevent database deletion within minutes? If not, improve the architecture before improving the dashboard.
Do not over-focus on the AI label
The entry point was a known vulnerability on an exposed service. The attack still depended on credentials, reachability and excessive privilege. Those are familiar control failures.
Agentic operation raises pace and adaptability; it does not make basic security obsolete. The strongest response is to patch exposed systems, reduce standing privilege, segment production and automate trustworthy containment. JADEPUFFER is a warning that attackers may now exploit weak boundaries at machine speed.
Source
Update, 1 September 2026: four later Langflow flaws kept the same boundary exposed
The original JADEPUFFER intrusion used CVE-2025-3248. Four 2026 Langflow vulnerabilities show that the platform’s code-execution and tenant boundaries remained an active target after that campaign.
- CVE-2026-0770 allows remote attackers to execute arbitrary code in affected Langflow 1.4.2 installations.
- CVE-2026-33017 lets an unauthenticated attacker build public flows and reach code execution in versions before 1.9.0. Public exploit material is available.
- CVE-2026-55255 lets an authenticated user specify another tenant’s flow identifier and execute that flow. Versions before 1.9.1 are affected.
- CVE-2026-9198 is a critical unauthenticated code-injection flaw affecting default deployments through Langflow 1.10.0.
CISA lists all four as known exploited. Operators should remove Langflow from direct internet exposure, apply the fixed release specified by each advisory, rotate secrets available to flows and investigate for child processes, unexpected flow execution, environment-variable access and outbound callbacks.
Primary sources: Langflow advisory for CVE-2026-33017, Langflow advisory for CVE-2026-55255, IBM advisory for CVE-2026-9198, ZDI advisory for CVE-2026-0770 and the CISA KEV catalogue.
