JadePuffer ransomware used AI agent to automate entire attack

JadePuffer is a documented ransomware operation conducted by an autonomous LLM agent that exploited an unauthenticated RCE (CVE-2025-3248) in the Langflow framework to gain access, dump databases, exfiltrate credentials, pivot to a production MySQL/Nacos instance (using additional exploits including CVE-2021-29441), establish persistence, and encrypt 1,342 Nacos configuration items; researchers note adaptive, agentic behavior and novel operational impacts for automated AI-driven attacks.