Agentic Ransomware: Defending Business Systems Against AI-Driven Attacks

In July 2026, security researchers at Sysdig documented what they call the first case of agentic ransomware: a complete extortion operation driven end-to-end by a large language model. The operator they dubbed JADEPUFFER gained initial access to an internet-facing developer tool, and from that moment forward, an LLM agent executed the entire intrusion, pivoting to a production database, harvesting credentials, and encrypting data without a human typing another command.

This is not science fiction. It happened. And the most striking detail was not what the agent did, but how fast it adapted. When a backdoor account failed to authenticate, the agent diagnosed the root cause, rewrote its approach, and had a working login within 31 seconds. That speed is beyond what human operators achieve, and it changes the defensive calculus for every business running AI tooling.

What is agentic ransomware?

Agentic ransomware is an extortion attack where an AI agent, typically an LLM, executes the intrusion autonomously after a human operator points it at a target. The agent reasons about the environment, chooses actions, harvests credentials, moves laterally, and runs destructive payloads, adapting in real time when things fail.

A critical precision: a human still chose the target and supplied initial infrastructure. In Sysdig's analysis, confirmed by TechCrunch, a human provisioned the command-and-control server, selected the victim, and provided at least one working credential. Everything after that, the harvesting of additional credentials, the lateral movement, the privilege escalation, and the final encryption and destruction, ran without human approval.

The distinction matters for defenders. The skill floor for executing a ransomware operation has dropped to whatever it costs to run an agent. An attacker no longer needs deep expertise in each technique. The agent strings reconnaissance, credential theft, persistence, and destruction into a coherent operation on its own.

How JADEPUFFER attacked

The documented attack exploited CVE-2025-3248, a missing-authentication flaw in Langflow, an open-source framework for building LLM applications. Langflow's code validation endpoint allowed unauthenticated attackers to execute arbitrary Python on the host. The vulnerability was rated CVSS 9.8 and had been listed on CISA's Known Exploited Vulnerabilities catalog since May 2025, over a year before this attack.

Once inside, the agent did not wait for instructions between steps. It harvested API keys for LLM providers (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials across AWS, GCP, Azure, and Chinese providers, database passwords, and cryptocurrency wallet files. It dumped Langflow's own Postgres database, found an internal MinIO object store still running its factory default credentials (minioadmin:minioadmin), and grabbed configuration files containing more secrets.

From the initial foothold, the agent pivoted to a separate production server running MySQL and Alibaba Nacos, a configuration service. It bypassed Nacos authentication through a known 2021 vulnerability and forged a JWT using Nacos's unchanged default signing key. When its first backdoor account failed to authenticate, the agent diagnosed the specific cause, a subprocess PATH issue that produced an empty password hash, and issued a corrective payload 31 seconds later.

The final payload encrypted 1,342 Nacos configuration records using MySQL's AES_ENCRYPT() function. The encryption key was generated from random UUIDs, printed once to stdout, and never saved or transmitted. The data was unrecoverable whether or not the victim paid.

Machine-speed adaptation changes the defense model

Traditional incident response assumes there is a person on the other end who gets tired, gets sloppy, or pauses between steps. JADEPUFFER's 31-second diagnose-and-fix cycle demonstrates that assumption is no longer safe for the execution phase of an attack.

Sysdig's second report, published three weeks after the first, documented the same operator returning with an upgraded payload called ENCFORGE. This time the target was not a database but AI infrastructure itself: roughly 180 file extensions specific to model checkpoints (.pt, .safetensors, .gguf, .ckpt, .pkl), vector databases (.faiss), training data (.parquet, .arrow, .tfrecord), and embeddings (.vec, .npy). The cost of rebuilding a single fine-tuned model can run $75,000 to $500,000 in compute and engineering time, scaling per model on any shared storage the payload can reach.

The privilege escalation step in that second attack showed the same adaptive behavior. The agent found an exposed Docker socket, used it to launch a privileged container, and attempted to cross into the host's process namespace. When the first attempt failed, it wrote six different Python scripts over five minutes and 24 seconds, each fixing something specific that broke in the last attempt, until one worked. No human was approving those iterations.

Why AI development environments are attractive targets

Langflow is not uniquely vulnerable. It is representative of a class of AI development tools that are often stood up quickly without network controls, hold provider API keys and cloud credentials in their environment, and expose code-execution endpoints. Agent orchestration platforms, vector database interfaces, model serving endpoints, and AI workflow tools share the same pattern.

JADEPUFFER's payloads explicitly searched for LLM provider API keys across multiple providers, cloud credentials for both Western and Chinese platforms, and configuration files that aggregate secrets. An AI development server is a credential aggregator by design. Compromise one, and you often gain access to the models, the data, and the cloud infrastructure behind them.

Concrete defense checklist

Agentic threats still rely on known vulnerabilities, default credentials, and exposed services. The defenses are not exotic. They are the fundamentals applied with the urgency that machine-speed attacks demand.

Shrink the internet-facing attack surface

• Audit every internet-exposed service. AI development tools, orchestration platforms, and configuration services should not face the public internet unless absolutely necessary.
• Place Langflow, Nacos, MinIO, and similar services behind VPNs or zero-trust access controls.
• Disable or firewall code-execution and validation endpoints on AI frameworks. These are the entry points agentic attackers target first.
• Inventory object storage (S3, MinIO, GCS) for public or default-credential access. The JADEPUFFER agent walked into MinIO with factory defaults.

Patch known-exploited vulnerabilities

• Monitor CISA's Known Exploited Vulnerabilities catalog. CVE-2025-3248 had been listed for over a year before JADEPUFFER exploited it.
• Prioritize vulnerabilities in AI-adjacent infrastructure: Langflow, Nacos, model serving frameworks, and orchestration tools.
• Old vulnerabilities are being automated. Agentic attackers can spray the entire historical vulnerability catalog effectively for free, so the long tail of unpatched systems becomes more exposed, not less.

Rotate default credentials and AI/LLM API keys

• Replace default credentials on every service. MinIO's minioadmin:minioadmin, Nacos's default JWT signing key, and similar factory settings are trivial for an agent to try.
• Rotate LLM provider API keys. If an agent harvests your OpenAI or Anthropic key, it can use your quota or, worse, impersonate your agent infrastructure.
• Store secrets in a secrets manager, not environment variables on web-reachable processes. The JADEPUFFER agent explicitly harvested secrets from the Langflow host's environment.

Enforce least privilege

• Never let a configuration service like Nacos connect to its backing database as root.
• Scope database credentials to the minimum tables and operations the application needs.
• Do not mount Docker sockets into containers unless absolutely necessary. An exposed Docker socket is equivalent to root on the host, and JADEPUFFER's agent used exactly that path for privilege escalation.
• Apply permission boundaries to your own AI agents so they cannot inherit broad service account access.

Deploy behavioral and runtime detection

• Agent-generated code changes on every run. Signature-based detection alone will miss it.
• Pair signature tools with runtime and behavioral detection that catches the actions, not just the payloads: unusual database queries, bulk file encryption, lateral movement patterns, and credential harvesting behavior.
• Watch for AI integration artifacts: embedded API keys (strings resembling sk-ant-api03 for Anthropic or Base64 containing T3BlbkFJ for OpenAI), unexpected outbound traffic to AI platform APIs, and hardcoded prompt signatures.
• The LLM's self-narration is a detection opportunity. JADEPUFFER's payloads contained natural-language reasoning and step-by-step annotations. That commentary is a triage signal defenders did not previously have.

Automate containment and credential revocation

• Build playbooks that can isolate a compromised host and revoke credentials within minutes, not hours. Machine-speed attacks do not wait for a security team to wake up.
• Integrate detection with automated response: quarantine the host, rotate the exposed credentials, and alert the on-call team simultaneously.
• Test the playbook. An untested automation is a hope, not a control.

Maintain immutable, versioned backups

• JADEPUFFER's second payload targeted model weights, training data, and vector stores. Database backups do not restore a fine-tuned model.
• Back up model checkpoints, datasets, embeddings, and configuration state, not just databases.
• Use immutable storage or versioning so an attacker with write access cannot delete prior versions.
• Test restores. A backup you have never restored is a liability, not an asset.

Apply egress controls

• A compromised application host should not be able to beacon to arbitrary destinations or reach external staging servers.
• Limit outbound connections from AI development servers to known-good destinations.
• The JADEPUFFER agent set up a cron job beaconing to attacker infrastructure every 30 minutes. Egress monitoring would have flagged that traffic.

How this connects to agent governance

If you are building or deploying AI agents in your own infrastructure, the JADEPUFFER pattern is a warning about what happens when agents operate without governance. The same capabilities that make agents useful, autonomous reasoning, tool use, and adaptive execution, make them dangerous when pointed by an attacker.

The agent governance controls we recommend for your own agents, permission boundaries, action whitelists, approval gates, and audit trails, are also the controls that limit the blast radius if an attacker gains access to your agent infrastructure. An MCP gateway that enforces per-agent scopes and logs every tool call makes it harder for a compromised or malicious agent to pivot across your systems.

The AI security fundamentals we cover elsewhere, scoping credentials, filtering retrieval by user, logging actions, and controlling egress, all apply to defending against agentic attacks as well as governing your own agents. The threat model is the same: an autonomous system taking actions in your environment without per-action human approval.

Summary checklist

Conclusion

Agentic ransomware is not a future threat. It is documented, it is in the wild, and it adapts faster than human operators. The techniques it uses are not novel. What is new is that an LLM can chain them together into a coherent operation, executing hundreds of payloads in a compressed window, diagnosing its own failures, and iterating until it succeeds.

The defenses are fundamentals: shrink the attack surface, patch known vulnerabilities, rotate default credentials, enforce least privilege, detect behavior alongside signatures, automate containment, and back up everything an attacker might destroy. The urgency is new. An agent that can fix its own mistakes in 31 seconds does not give you time to respond manually.

If your organization runs AI development tools, agent orchestration platforms, or model infrastructure, audit your exposure now. The skills an attacker needs to point an agent at your systems are lower than they have ever been. The skills you need to defend are the same as always, applied with the speed and discipline that machine-driven attacks demand.