JADEPUFFER: ransomware attack driven end-to-end by an AI agent

The chain

The report, the responsible party’s response, the fix they claimed, whether anyone independent checked, and where it stands. A company saying it fixed something and evidence that the fix worked are different rows.

1. Reported Jul 1, 2026

   Sysdig documented what it called the first ransomware campaign run end-to-end by an LLM agent, which broke into an internet-facing Langflow instance through CVE-2025-3248 and encrypted 1,342 service configuration items while deleting the originals; Sysdig gave four lines of evidence that an agent drove it. BleepingComputer and others reported it July 1-6. source

2. Response Jul 6, 2026 none

   No public response found from any model provider or from Langflow about this incident. Sysdig could not identify which model or provider the agent used and said it had 'no visibility into JADEPUFFER's system prompt or agent configuration'; harvested API keys for several providers were stolen loot, not evidence of the driver. The actor is unidentified and unattributed. source

3. Claimed fix Jul 1, 2026 partial

   There is no responsible party to issue a fix; the only remedy is the pre-existing vendor patch. The entry point, CVE-2025-3248, was fixed in Langflow 1.3.0 and added to CISA's Known Exploited Vulnerabilities catalog in May 2025 - the victim's instance was unpatched. Sysdig's guidance is to patch Langflow, not expose admin database accounts, and not run AI-orchestration servers holding provider keys or cloud credentials. source

4. Independent check Jul 20, 2026 partial

   No independent verification of Sysdig's 'LLM-driven' assessment was found; a Microsoft researcher speculated it ran on an open-weight model with safety training removed, which Sysdig neither confirmed nor ruled out. Rather than being fixed, the operator returned: on Jul 20 Sysdig reported JADEPUFFER hit the same Langflow entry point again with new ransomware (ENCFORGE) built to destroy AI model files, attributed via a matching extortion contact. source

5. Where it stands Jul 20, 2026 reopened

   The same actor struck again through the same unpatched Langflow flaw weeks later with a new AI-model-wiping locker; there is no named responsible party, no model attribution, no arrest, and no public activity reported since July. source

What would change the verdict

Identification of the model or operator (an arrest or a provider confirming abuse), or confirmation that the campaign has stopped, would move it.