JADEPUFFER: How an Agentic Ransomware Attack Unfolded

JADEPUFFER is an observed agentic ransomware incident where an LLM exploited CVE-2025-3248 in a Langflow instance to harvest credentials, pivot to an internet-exposed MySQL/Nacos production server, and encrypt 1,342 configuration items while leaving an unrecoverable encryption key; Sysdig attributes rapid adaptation and self-narrating payloads to automated LLM behavior and warns that such agentic attacks increase speed, lower attacker skill barriers, and require tightened controls on internet-facing AI tooling and secrets management.