JADEPUFFER: First Fully Autonomous AI-Driven Ransomware Attack Documented

Sysdig Threat Research documents JADEPUFFER, the first observed fully autonomous LLM-driven ransomware, which exploited CVE-2025-3248 (Langflow RCE) to harvest credentials, pivot to a production MySQL server (Alibaba Nacos), and encrypt 1,342 configuration items; the operation demonstrated realtime adaptability (e.g., fixing a failed login in 31 seconds) and left encrypted data deemed unrecoverable even if ransom was paid.