JadePuffer Ransomware Used AI Agent to Automate Entire Attack

## Executive summary: Researchers reported JadePuffer, a ransomware operation automated end-to-end by an autonomous LLM agent that exploited CVE-2025-3248 in Langflow to dump databases, harvest credentials, pivot to a production Nacos/MySQL environment, establish persistence, and encrypt 1,342 service configuration items; defenders are advised to patch Langflow, restrict internet exposure of AI development tools, harden secrets/config stores, and hunt for agentic attack behaviors.