JADEPUFFER: Agentic Ransomware Arrives — and Why Detection Alone Won't Save You

Published: July 2026 · By Patrick Belcher, Salience Cyber

On July 1, 2026, Sysdig’s Threat Research Team published what many in the industry are calling a landmark report: the first clear case of fully agentic ransomware executed end-to-end by a large language model. They named the operator JADEPUFFER.

This wasn’t theoretical. It wasn’t proof-of-concept in a lab. It was a real incident observed in the wild where an LLM autonomously:

Gained initial access via a known vulnerability
Conducted reconnaissance and credential harvesting at scale
Adapted its own tactics in real time when steps failed
Pivoted to the high-value target
Executed destructive encryption and extortion

All without ongoing human direction after the initial trigger.

The Attack in Detail

The entry point was an internet-facing Langflow instance vulnerable to CVE-2025-3248 (missing authentication in the code validation endpoint, allowing unauthenticated arbitrary Python execution). Langflow is a popular open-source framework for building LLM-powered applications and agent workflows — exactly the kind of AI-adjacent service that often gets stood up quickly with insufficient hardening.

Once inside, the agent performed parallel, intelligent enumeration:

Host and process reconnaissance
Sweeping for secrets (LLM provider API keys from multiple vendors, cloud credentials including explicit coverage of Chinese providers, database creds, cryptocurrency wallets)
Dumping Langflow’s own Postgres backing database
Internal network scanning and service discovery
Targeting MinIO object storage (using default credentials) to pull configuration and credential files

It then established persistence via a cron beacon and moved to its true objective: a separate production server running MySQL and Alibaba Nacos (a service discovery and configuration platform).

On the target, the agent used multiple vectors (including known Nacos auth bypasses and default JWT signing key forgery) plus direct root database access to inject a backdoor administrator. When the initial bcrypt-hashed admin account didn’t work as expected, it self-corrected 31 seconds later — deleting the account, regenerating the hash, and recreating and verifying the administrator login. It then ran methodical container-escape probes via MySQL file primitives before moving to the ransomware phase.

The final act: encrypting 1,342 Nacos configuration items using MySQL’s AES_ENCRYPT(), dropping the original and history tables, and creating a README_RANSOM table with a demand, Bitcoin address (3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy — a common sample address), and Proton Mail contact. The encryption key was generated randomly on the fly and printed to stdout but never persisted or exfiltrated, meaning payment would not have restored the data. The ransom note itself showed classic LLM characteristics — slightly off phrasing and reliance on generic templates.

Sysdig published clear indicators of compromise, including the C2 IP (45.131.66[.]106 with 30-minute beacons) and staging server references.

Why This Changes Everything

What makes JADEPUFFER different from previous AI-assisted attacks is the autonomy and adaptability. Earlier uses of LLMs by attackers were mostly for generating phishing content, writing malware, or assisting reconnaissance. Here, the model drove the entire operation with plan-act-observe-adjust loops, self-narration in payloads, and rapid self-correction.

The 31-second correction window is particularly sobering. By the time a traditional SIEM or SOC workflow surfaces an anomalous login or failed auth attempt, the agent has already succeeded and moved on. Human responders cannot keep up with machine-speed iteration.

Even more concerning is that JADEPUFFER was clearly not the sharpest LLM in the drawer. The operation exhibited classic signs of mid-tier or training-data-influenced behavior — including a canonical sample Bitcoin address and a ransom note with odd phrasing typical of generative hallucinations. This was a capable LLM that ran a complete, adaptive ransomware campaign, but far from a frontier model. Imagine what today’s most advanced reasoning models, with superior long-horizon planning, tool integration, and fewer safeguards, could achieve.

Visibility Is Necessary — But Not Sufficient

Sysdig’s write-up is excellent. Their runtime visibility and behavioral detection captured rich artifacts that allow us to study and learn from JADEPUFFER. Tools focused on observability, EDR/XDR, and cloud security are critical for forensics, threat hunting, and understanding novel TTPs.

However, once encryption and table drops begin, the damage is already done. In this case, the victim faced data loss regardless of whether they paid the ransom.

The industry needs to shift from “detect and respond faster” to predict and prevent earlier.

Where Predictive, Neuromorphic Defense Fits

At SalienceCyber.ai, we’re building a multi-layer platform grounded in neuromorphic principles — specifically Hierarchical Temporal Memory (HTM) and Sparse Distributed Representations (SDR). Inspired by how the neocortex models sequences and makes predictions at very low energy cost, these methods learn what normal looks like from sparse data and flag deviations from it as they happen, rather than waiting to match a known signature.

Browser layer (via our extension): Many initial access vectors — phishing, malicious links, or web-based exploits — begin in the browser. Predictive modeling can identify anomalous navigation, form interactions, or payload delivery patterns before execution reaches the server.
Endpoint / Computer Core layer: LLM-generated payloads running reconnaissance, credential sweeps, and self-correcting loops produce behavioral sequences that diverge from ordinary application and user activity. Because the approach reasons from learned structure rather than fixed rules, it can flag that divergence even when the specific code is new or polymorphic — and act on it earlier in the chain, before encryption and table drops make the outcome irreversible.

The same sparse coding that allows the brain to anticipate the next note in a melody or the next word in a sentence can anticipate the next step in an attack chain. And block it.

What Enterprises Should Do Now

Inventory and harden AI-adjacent services — Langflow, Nacos, and similar tools are powerful but must be treated with the same rigor as any internet-facing application (least privilege, network segmentation, rapid patching, no default creds).
Assume agentic speed — Your detection and response playbooks must account for sub-minute adaptation windows. Invest in automation but prioritize prevention layers that act before the chain completes.
Layer predictive controls — Combine strong visibility (traditional EDR/XDR) with predictive prevention that operates at machine speed on behavioral sequences.
Prepare for imperfect but effective attacks — Hallucinated notes or sample addresses won’t stop data destruction. Focus on blocking execution and lateral movement, not just identifying “known bad” artifacts.

The Path Forward

JADEPUFFER is not the end — it is the beginning of a new category of threat. Agentic AI will continue to evolve, becoming faster, more reliable, and more accessible to a wider range of actors.

The organizations that thrive will be those that move beyond reactive visibility to proactive, predictive prevention that understands normal behavior deeply enough to recognize and stop the abnormal — even when the abnormal is written by another AI in real time.

At SalienceCyber.ai, that is exactly the future we are engineering.

If you’re evaluating how to harden your environment against agentic threats, or want to discuss detection/prevention strategies, we’re happy to connect.

Read the original Sysdig report here: sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion