Agentic Ransomware: When the Attacker Is a Language Model

Sysdig published research last week on what they call the first documented case of "agentic ransomware," a complete extortion operation driven end-to-end by a large language model [1]. They named the agent JadePuffer. It exploited a known vulnerability, harvested credentials, moved laterally across machines, encrypted a production database, and left behind a Bitcoin ransom demand. No human operator in the loop.

This is not a theoretical concern anymore. It happened.

The Attack Chain

JadePuffer gained initial access through CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow, a popular open-source framework for building LLM applications [2]. The vulnerability was patched in April 2025 and CISA flagged it as actively exploited the following month, but unpatched instances remain a persistent problem [3].

From there, the AI agent executed over 600 coordinated payloads. It dumped the Langflow PostgreSQL database, collected host information, searched for environment variables and sensitive files, and enumerated a MinIO object store. When one API request returned XML instead of JSON, the next payload automatically adjusted its parsing logic. That kind of on-the-fly adaptation is exactly what makes an LLM-driven attack different from a static exploit chain.

The agent then pivoted to a production MySQL server running Alibaba Nacos, a configuration management platform. It used root credentials to access the server and exploited CVE-2021-29441, an authentication bypass that creates rogue administrator accounts. When the first attempt to create an admin account failed, the agent diagnosed the error and produced a corrected payload within 31 seconds [4].

Finally, JadePuffer encrypted 1,342 Nacos configuration records using MySQL's AES_ENCRYPT function, deleted the original tables, and created a ransom table containing a Bitcoin payment address and a Proton Mail contact [5].

What Makes This Different

Ransomware operations have been automated for years. Initial access brokers sell credentials, botnets distribute payloads, and encryption is a script that runs once triggered. The difference here is decision-making.

A traditional automated attack follows a predetermined path. If a step fails, it either retries blindly or stops. JadePuffer adapted. It read error messages, understood what went wrong, and wrote new code to work around the problem. Sysdig noted that the payloads contained "natural language reasoning, target prioritization, and the kind of detailed annotations that human operators don't often write but LLM-generated code produces reflexively" [6].

That self-narrating quality is also a detection opportunity. LLM-generated code tends to include verbose comments explaining operational reasoning, something human attackers rarely do. Security tools can look for that pattern.

The Bitcoin Address Tells a Story

One detail that caught my attention: the Bitcoin address in the ransom note is a well-known example address from public documentation. Sysdig believes the LLM pulled it from its training data rather than generating a real wallet. The encryption key was randomly generated but never stored or transmitted back to the attacker.

This suggests the operation was more of a demonstration than a polished criminal campaign. But that is cold comfort. The gap between "proof of concept" and "real threat" is narrowing fast, and the next iteration will likely fix these mistakes.

Lowering the Barrier

A cybersecurity researcher quoted in the Sysdig coverage made an important point: AI does not replace experienced attackers, but it lowers the operational barrier [7]. Someone with basic technical knowledge and access to an LLM agent could potentially run a ransomware operation that previously required a team with specialized skills in reconnaissance, credential theft, lateral movement, and encryption.

The traditional detection model assumes attackers follow predictable paths. An AI agent that can change tactics when something is blocked makes every intrusion look slightly different. The quiet phase before encryption, where the agent maps identities, privileges, and trust relationships, is where the real danger lies.

What Defenders Should Take Away

First, patch your Langflow instances. CVE-2025-3248 has been fixed for over a year, and it is still being exploited because people leave internet-facing services unpatched.

Second, detect behavior, not just signatures. The adaptive nature of LLM-driven attacks means static indicators of compromise are less useful. Suspicious identity activity, privilege escalation, abnormal authentication patterns, and unusual sequences of actions across systems are what will catch these campaigns.

Third, the LLM-generated code itself is a fingerprint. Verbose natural-language comments, self-narrating payloads, and rapid iterative correction are patterns that human operators do not produce. Security tools should flag them.

The age of agentic threat actors has arrived. It is not a revolution in ransomware technique, but it is an evolution in execution that changes the economics of attacks. When the attacker is a language model, scale is free and adaptation is automatic. Defenders need to assume their adversary can think, not just execute.