The First AI Agent Ransomware Attack Used a No-Code AI Workflow Builder as Its Entry Point

For years, security researchers warned that AI agents would eventually be weaponised for ransomware. The nightmare scenario was always the same: an autonomous AI, given a goal and a set of tools, methodically breaking into systems, stealing credentials, and encrypting everything it could reach. No human at the keyboard. No hesitation. No sleep.

On 1 July 2026, Sysdig's Threat Research Team confirmed it had actually happened.

The operation, tracked as JADEPUFFER, is the first documented case of agentic ransomware: a complete extortion campaign driven end-to-end by a large language model. And the entry point wasn't some obscure zero-day in enterprise infrastructure. It was Langflow, a popular open-source no-code AI workflow builder with over 79,000 GitHub stars.

That detail matters enormously for anyone building with no-code AI tools. Let me explain why.

What JADEPUFFER actually did

The attack began with CVE-2025-3248, a missing-authentication vulnerability in Langflow's `/api/v1/validate/code` endpoint. Rated 9.8 on CVSS, it let any unauthenticated attacker send crafted HTTP requests and execute arbitrary Python on the server. The vulnerability had been patched since May 2025 and listed in CISA's Known Exploited Vulnerabilities catalogue. The compromised instance simply hadn't been updated.

Once inside, the LLM agent didn't wait for instructions. It immediately enumerated the host, checking OS details, running processes, and network interfaces. Then it swept the environment for secrets in parallel: API keys for OpenAI, Anthropic, DeepSeek, and Gemini. Cloud credentials for AWS, Azure, GCP, Alibaba, and Tencent. Cryptocurrency wallet seeds. Database connection strings. Configuration files.

It dumped Langflow's own PostgreSQL database, harvesting stored credentials and user records. It scanned internal address spaces, probing databases, object stores, and secret-management endpoints with default credentials. It found a MinIO object store secured with `minioadmin:minioadmin` — yes, the factory defaults — and enumerated buckets containing application data, backups, ML artifacts, and a `terraform-state` bucket.

Then it installed a cron job to beacon back to attacker infrastructure every 30 minutes, and pivoted to its real target: a production MySQL server running Alibaba Nacos, a configuration and service-discovery platform.

Here's where it gets properly unnerving. The agent tried to create a rogue Nacos administrator account. The first attempt failed. It diagnosed the error and returned with a corrected payload in 31 seconds. No human review cycle. No consultation. Just an AI agent debugging its own exploit in under a minute.

The final phase was destructive. JADEPUFFER encrypted 1,342 Nacos service configuration items using MySQL's `AES_ENCRYPT()` function, dropped the original configuration and history tables, and created a `README_RANSOM` table with a Bitcoin address and Proton Mail contact.

One grim detail: Sysdig found the encryption key was generated randomly, printed once, and never saved or transmitted. Paying the ransom wouldn't have restored the data.

Over 600 distinct payloads were generated and executed across the operation. The code was self-narrating, filled with natural-language comments explaining what each step was doing and why. The kind of annotation human operators rarely bother with, but the sort LLMs produce reflexively.

Why no-code AI builders are the perfect entry point

Langflow is a properly useful tool. It lets you build AI agents and workflows by dragging, dropping, and chaining components. No code required. It connects to LLMs, vector databases, APIs, and data stores. It's exactly the kind of platform that makes AI agent development accessible to teams who don't have dedicated ML engineers.

But that accessibility creates a structural security problem that I think we've been too slow to take seriously.

No-code AI platforms sit at a uniquely dangerous intersection. They hold provider API keys and cloud credentials in their environment because they need them to function. They execute arbitrary code, often Python, as part of their core operation. They connect to databases, object stores, and internal services. And they're frequently deployed by small teams moving fast, without the network controls, patching discipline, or security review that traditional production services receive.

Sysdig's researchers put it bluntly: Langflow instances are attractive targets precisely because they are "AI-adjacent, frequently hold provider API keys and cloud credentials in their environment, and are often stood up quickly without network controls."

JADEPUFFER didn't use any novel exploit techniques. Every vulnerability it hit was known and patched. What made it work was the concentration of value. One compromised Langflow server turned into root access on a production database, simply because the credentials were there, the network path was open, and nobody had applied two years of patches.

Three things every no-code AI builder needs to do right now

If you're running Langflow, n8n, Make, or any other no-code platform that connects AI agents to your infrastructure, here's where to start.

First, patch everything. CVE-2025-3248 was fixed in Langflow 1.3.0 over a year ago. If you haven't upgraded, you're not behind. You're a target. Check every instance. Now.

Second, never expose these platforms directly to the internet. Put them behind a VPN, a zero-trust proxy, or at minimum an identity-aware gateway. The Langflow instance in this attack was internet-facing with no authentication. That's not an edge case. Censys found roughly 470 internet-facing Langflow instances at the time of the initial CVE disclosure.

Third, assume compromise and limit the blast radius. The AI agent pivoted from Langflow to a production database because the network path was wide open. Use network segmentation. Rotate credentials stored in these platforms regularly. Give the platform's service account the minimum permissions it actually needs, not root and not broad database access. If the agent can't reach the production server, the attack stops at phase one.

The architectural argument

There's a broader lesson here that goes beyond patching and network controls. The platform architecture itself is either a security control or a security liability.

Langflow, like many open-source AI workflow tools, gives you raw execution. You can run arbitrary Python. You can connect to anything. That's powerful, and it's also exactly what an attacker wants.

Structured no-code platforms with built-in governance models — role-based access control, sandboxed execution environments, audit trails — structurally prevent the attack chain JADEPUFFER exploited. If the platform's execution environment is sandboxed, arbitrary Python can't escape to the host. If permissions are enforced at the platform layer, a compromised workflow can't reach databases it wasn't authorised to touch. If every action is logged to an audit trail, lateral movement doesn't happen silently.

These aren't features you bolt on after a breach. They're properties of the architecture itself. The platform's permission model IS the security boundary.

This is the argument we've been making at nocode.tech for a while, and JADEPUFFER makes it concrete. When you connect an AI agent to production systems, the governance layer isn't optional. It's the difference between "agent made a mistake" and "agent encrypted your production database."

The takeaway

JADEPUFFER isn't the last agentic ransomware attack. It's the first. The barrier to entry has dropped from "skilled human operator" to "capable language model and an unpatched server." That changes the volume math entirely.

For no-code builders, the uncomfortable truth is that the tools making AI accessible are also making AI-powered attacks accessible. The same drag-and-drop workflow that builds your customer-support chatbot can be the entry point for an autonomous ransomware campaign.

The fix isn't to stop using these tools. It's to treat them as what they actually are: production infrastructure that holds production credentials and connects to production systems. That means patching discipline, network controls, and, if you're building anything that matters, choosing platforms where the architecture itself is the security model.

The age of agentic threat actors is here. Your agent deployment strategy is now your security strategy, whether you planned it that way or not.