The First AI Agent Ransomware Used a No-Code Workflow Builder as Its Entry Point — What Every Team Must Learn

TL;DR — Sysdig has documented JADEPUFFER, the first ransomware campaign driven end-to-end by an AI agent. Entry point: Langflow, an open-source no-code AI workflow builder with 79K+ GitHub stars, exploited through CVE-2025-3248 (CVSS 9.8, patched since May 2025). The agent executed 600+ payloads autonomously, moved to a production database, encrypted 1,342 configuration records, and left a Bitcoin ransom. Then it returned with purpose-built ransomware targeting AI models. This is what happens when no-code AI infrastructure meets neglected security patches.

On July 1, Sysdig's Threat Research Team published something genuinely new: the first documented case of agentic ransomware. Not AI-assisted ransomware, where a human writes the scripts and an LLM polishes the email. Agentic — where an AI agent, operating without step-by-step human direction, executed the full intrusion chain from initial access to database extortion to ransom delivery.

They named the operator JADEPUFFER. Its entry point was Langflow.

If you don't know Langflow: it's a popular open-source visual framework for building LLM-powered applications and agent workflows. 79,000+ stars on GitHub. Python-based, LLM-agnostic, lets you drag and drop components to build AI pipelines. It's the kind of tool a team spins up quickly to prototype an AI feature, often without the security review that would accompany a production service.

That last part is the problem.

The vulnerability that started it

CVE-2025-3248 is a missing-authentication flaw in Langflow's code validation endpoint — the sort of thing where submitted code executes before the system checks who sent it. Any unauthenticated attacker who can reach the endpoint can run arbitrary code on the host. CVSS score: 9.8. Patched in Langflow 1.3.0 on March 31, 2025. Added to CISA's Known Exploited Vulnerabilities catalogue on May 5, 2025.

JADEPUFFER exploited this flaw in late June 2026 — more than a year after the patch shipped. The victim was running an unpatched, internet-facing Langflow instance. That's not a sophisticated attack. That's an unpatched known vulnerability on an exposed service. The AI agent just happened to be the thing that exploited it.

The attack chain

What makes this worth paying attention to isn't the initial access — it's everything that happened next. The LLM-driven agent executed a multi-phase campaign that Sysdig captured in unusual detail:

Phase one — reconnaissance and credential harvesting. Immediately after gaining access, the agent enumerated the host and swept for secrets across every category: API keys for OpenAI, Anthropic, DeepSeek, Gemini; cloud credentials for AWS, GCP, Azure, and Chinese providers; cryptocurrency wallet material; database credentials. It extracted Langflow's backing PostgreSQL database, harvested the stored credentials, reviewed the output, then cleaned up.

Phase two — lateral discovery. The agent scanned internal address space and named services reachable from the Langflow host. It discovered a MinIO object storage instance secured with well-known default credentials. It listed all buckets — application data, backups, ML artifacts, a Terraform state bucket — and fetched configuration files by name.

Phase three — the real target. The agent moved from the Langflow host to a separate production server running MySQL and Alibaba Nacos, a configuration and service-discovery platform. It used previously obtained root credentials. It exploited CVE-2021-29441, a five-year-old Nacos authentication bypass, combined with Nacos's publicly documented default signing key to create an administrator account.

Phase four — encryption and extortion. The agent encrypted all 1,342 Nacos service configuration items, deleted the originals, and left an extortion message with a Bitcoin address. Critically, the encryption key was generated randomly and never stored or transmitted. The victim cannot recover their data even with payment. This was data destruction dressed as extortion.

What makes it agentic

Sysdig identified several behavioural signals that distinguish this from a scripted attack:

- Self-narrating payloads. The LLM included natural-language commentary in its code — reasoning, target prioritisation, annotations explaining what each step was doing. Human operators don't write comments like that. LLMs do, reflexively.
- **Real-time adaptation.** When an initial account creation attempt failed, the agent diagnosed the problem, switched techniques, regenerated the necessary components, cleaned up the broken attempt, and succeeded — all within 31 seconds.
- **In-session comprehension.** When an API returned XML where the agent expected JSON, it reformulated its parser on the fly. When a database command failed, it automatically adjusted and retried.

This is an agent reading error messages, understanding them, and modifying its approach — at a speed no human operator can match. Sysdig's director of threat research, Michael Clark, put it plainly: "The model closed loops that used to require a skilled human."

Two weeks later, it got worse

On July 20 — less than three weeks after the initial publication — Sysdig reported that JADEPUFFER returned to the same Langflow instance with a materially upgraded capability. Where the first campaign used improvised Python scripts, the second deployed ENCFORGE: a compiled Go ransomware binary specifically built for AI and machine learning infrastructure. It targets approximately 180 file extensions spanning model checkpoints, vector databases, training datasets, and embedding indices.

Encrypted AI model artifacts cannot be restored by paying a ransom. You have to re-train them — at $75,000 to $500,000 per model in compute and engineering time. JADEPUFFER is destroying the one thing an organisation can't restore from backups.

Three things every no-code team must do

One: Patch Langflow now. If you're running any version below 1.3.0, you are vulnerable to the exact same entry vector. Langflow's internet exposure is higher than most teams realise — deployments are often stood up quickly without network controls, and they frequently hold provider API keys and cloud credentials in their runtime environment.

Two: Treat no-code AI platforms as production infrastructure. The attacker entered through the AI tooling, harvested credentials, and moved to production systems. The AI workflow builder was the soft entry point. If your team is running Langflow, Flowise, Dify, or any similar platform, it needs the same security posture as your production database: patched, authenticated, network-segmented, and monitored.

Three: Assume AI agents will be used against you. The skill floor for running a full ransomware operation just dropped to whatever it costs to run an agent. Clark again: "Defenders should expect the volume and breadth of such campaigns to rise as agentic tooling matures." The attack didn't use novel exploits. It used known vulnerabilities against neglected infrastructure. The AI agent just executed the chain faster and more adaptively than a human could.

The architectural defence

Platforms that don't expose raw code execution and enforce authentication by default structurally prevent this attack class. Langflow's vulnerability was an unauthenticated code execution endpoint that shouldn't have existed. Governed no-code platforms like Stacker don't have code execution endpoints. They don't evaluate user-supplied code server-side. They enforce authentication at every layer — you can't reach a data endpoint without proving who you are and what you're permitted to do.

That's not a small architectural difference. It's the difference between "patch this specific endpoint before someone finds it" and "there's no endpoint to patch because the platform was designed so that arbitrary code execution isn't possible." For teams running business-critical automation, the latter is worth a lot more than 79,000 GitHub stars.

The takeaway

JADEPUFFER is a warning shot. The first documented case of agentic ransomware used a no-code AI workflow builder as its entry point, exploited a vulnerability patched 14 months earlier, and executed a full intrusion chain at machine speed. The AI didn't invent new techniques — it just applied known techniques more thoroughly and adaptively than a human could. The targets were unpatched, internet-exposed, and credential-rich.

Patch your Langflow instances. Segment your AI infrastructure. Rotate your credentials. And if you're choosing a platform for business-critical automation, pick one where the architecture makes this kind of attack impossible — not one where you're one missed patch away from an AI agent encrypting your production database.