AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack

Sysdig reports JADEPUFFER, an apparently autonomous AI agent that exploited Langflow CVE-2025-3248 to execute an end-to-end ransomware operation: it achieved RCE, harvested API/cloud/database credentials, pivoted to a MySQL/Nacos host, encrypted Nacos settings and deleted databases, leaving ransom notes and network beacons; the report includes IOC details (C2 IPs, Bitcoin address, scheduled beacon) and remediation advice (patch Langflow, protect secrets, harden Nacos and database exposure).