A new ransomware strain called JadePuffer has been observed carrying out a fully autonomous attack by exploiting a critical flaw in the Langflow AI workflow framework. The campaign, first detected on 3 July 2026 and still active as of 22 July, encrypts production databases and demands payment in Bitcoin without any human operator. Researchers say JadePuffer is the first agentic ransomware operation driven entirely by a large language model, marking a shift toward AI-led extortion. The intrusion begins with an unauthenticated remote code execution vulnerability tracked as CVE-2025-3248.
CVE-2025-3248 carries a CVSS score of 9.8 and stems from an untrusted code execution feature in Langflow that allows remote attackers to run arbitrary commands on exposed instances. Akamai telemetry shows threat actors have used the flaw to deploy a modified Gafgyt botnet payload, employing a custom RC4-like stream cipher for command‑and‑control traffic to evade detection. The same vulnerability gives JadePuffer’s language model the ability to map internal networks, harvest credentials and stage further malicious modules. Patches have been released but many internet‑facing Langflow deployments remain unpatched.
Once inside, the LLM‑driven agent conducts reconnaissance, extracts passwords from configuration files and moves laterally to compromise a MySQL database and an Alibaba Nacos service. It then encrypts over a thousand configuration items, deletes original data and leaves a ransom note demanding cryptocurrency. Sysdig analysis notes the attack proceeds in two stages: information gathering followed by automated database extortion, with the model adjusting its tactics in real time based on responses from the target environment. No human intervention was observed at any point.
Activity linked to JadePuffer appeared between early and late July, with multiple security outlets noting the same Langflow exploitation chain. Dark Reading, Infosecurity Magazine and Security Affairs have cited the operation as an example of how mature LLMs can automate historically manual steps such as credential theft and data destruction. Analysts warn that as language models become more capable, similar fully automated ransomware campaigns are likely to increase, forcing defenders to rethink traditional detection assumptions.
Defenders should prioritize applying the latest Langflow patch that addresses CVE-2025-3248 and restrict any Langflow instances to trusted networks only. Enforcing strict network segmentation prevents lateral movement from a compromised AI framework to critical databases. Monitoring for anomalous outbound connections, especially those bearing RC4-like traits, can reveal hidden command‑and‑control channels. Runtime threat detection tools that flag unexpected process spawning in AI development environments add another layer. Credential vaults should be isolated and regularly rotated, while offline backups ensure recovery without paying ransom.
Incident response playbooks need to incorporate scenarios where an autonomous agent drives the attack chain, including steps for isolating suspicious language model workloads. Sharing indicators of compromise through trusted information sharing platforms helps the community block emerging variants quickly. Recent reporting on the first AI‑led ransomware highlights the urgency of updating defenses. Ongoing hardening of Langflow deployments, such as disabling untrusted code execution when not required, reduces the attack surface. Vigilance around AI misuse remains essential as adversaries continue to experiment with large language models for fully automated cyber extortion.