JadePuffer is the first documented ransomware to operate a complete attack kill chain using a large language model as its autonomous decision-making layer, without requiring human operator instruction at any stage after deployment. Sysdig researchers published analysis in July 2026 documenting the campaign, which exploited a critical RCE vulnerability in Langflow — the popular AI workflow orchestration platform — as its initial access vector.
The significance of JadePuffer isn’t primarily the ransom demand or the victim count. It’s the architectural shift. Traditional ransomware operators write tools, run them manually or via scripts, and make decisions throughout the attack. JadePuffer’s LLM layer makes those decisions — choosing lateral movement targets, correcting failed authentication attempts, adapting reconnaissance to the environment it finds — in real time and without human involvement.
Initial Access: CVE-2025-3248
JadePuffer’s documented entry point is CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow affecting versions prior to 1.3.0. The vulnerability exists in Langflow’s code execution endpoint, which permitted arbitrary Python execution without authentication in default deployments.
Langflow’s popularity in AI development pipelines made it an attractive target. At the time of JadePuffer’s campaign, a significant number of Langflow instances were internet-accessible — developers and data teams deploy it for prototyping AI workflows without always hardening it as they would a production service. Shodan data showed several thousand publicly accessible Langflow instances during the period Sysdig documented the campaign.
Once code execution was achieved, JadePuffer established persistence using a Python-based implant that connected to the LLM control layer for further instruction.
The Autonomous Kill Chain
What Sysdig documented was a complete attack lifecycle driven by LLM decision-making across every phase:
Reconnaissance: After initial access, the LLM orchestrator issued reconnaissance commands — process enumeration, network mapping, credential store identification — and interpreted the results to determine available attack paths. When standard reconnaissance returned limited results, the orchestrator adapted its approach without operator intervention.
Credential theft and authentication: JadePuffer targeted credential stores on the compromised host. In one documented case, it attempted to authenticate to a Nacos configuration management service using credentials extracted from the host. The initial authentication failed due to a token format issue. The Sysdig researchers noted that the LLM layer corrected the authentication approach within 31 seconds of the failure — identifying the error, adjusting the request format, and successfully authenticating on the next attempt. This self-correction loop, operating faster than most human analysts could diagnose an authentication error, is the operationally significant capability.
Exploiting secondary vulnerabilities: JadePuffer used a 2021 Nacos authentication bypass and unchanged default signing keys to escalate access to the Nacos instance after successful authentication. The orchestrator identified that Nacos was present, assessed its version, found relevant vulnerability conditions, and executed the exploit — a multi-step decision chain that previously required human expertise.
Lateral movement and privilege escalation: Using credentials and configuration data accessed via Nacos, the orchestrator mapped additional reachable services and attempted lateral movement, prioritising targets with configuration data, credentials, or administrative access.
Persistence and encryption: Terminal-phase activity included persistence mechanisms — scheduled tasks, service creation — and ransomware payload deployment. Encryption targeted file types associated with application data, databases, and configuration stores.
Sysdig’s analysis documented the full chain occurring within a single automated session. No evidence of human operator interaction was found in the command sequences.
Why This Changes the Threat Model
Conventional ransomware operations have a bottleneck: skilled operators. Conducting reconnaissance, identifying appropriate lateral movement paths, adapting to unexpected environments, and making real-time decisions about where to go next requires human expertise that doesn’t scale cheaply. This bottleneck limits how many concurrent operations a threat actor can run and creates response opportunities — the time between initial access and ransomware deployment often stretches to days or weeks precisely because humans are involved.
JadePuffer suggests a path around this bottleneck. If the LLM layer can handle reconnaissance, credential theft, lateral movement decisions, and vulnerability exploitation without human direction, an attacker could run simultaneous autonomous campaigns across many victims without linear scaling of operator effort.
The self-correction capability documented in the Nacos authentication incident is particularly significant. Conventional automated tools fail silently or stop when they hit unexpected conditions. An LLM-orchestrated attack can diagnose the failure and adapt — behaviour that previously required a human operator monitoring the campaign.
Attribution and Scope
Sysdig’s analysis did not definitively attribute JadePuffer to a known threat actor group. The campaign’s tooling and infrastructure showed overlap with financially motivated threat actors operating in the cloud and AI development platform targeting space, but attribution to a specific group was assessed as uncertain.
The scope of confirmed victims as of the Sysdig publication was limited — this was an early-campaign analysis rather than a retrospective on a widespread event. The operational significance is in what the capability represents for future campaigns rather than in the July 2026 victim count.
Indicators and Detection
Organisations running Langflow should prioritise patching to version 1.3.0 or later. CVE-2025-3248 has a CVSS score of 9.8 and has a published proof-of-concept — unpatched public-facing Langflow instances should be treated as likely compromised.
Detection logic to prioritise for environments that run or interface with AI development infrastructure:
- Unexpected outbound network connections from Langflow processes or their child processes
- Python process execution spawning shell commands outside normal Langflow operation paths
- Authentication to Nacos or other internal services from application service accounts that wouldn’t normally initiate those connections
- File encryption activity (high-volume file renames, unusual extension changes) on hosts running AI orchestration software
For Nacos specifically: instances running versions prior to 2.3.0 with default signing keys should be treated as compromised until those keys are rotated and the default credential bypass is addressed.