JADEPUFFER: ransomware attack run end-to-end by an AI agent

Damage

1,342 service configurations encrypted, originals deleted; ransom demanded

Did they fix it?

reopened The only fix is the old Langflow patch victims must apply themselves; the same operator came back through the same flaw in July, nobody has verified which model drove it, and there is no responsible party to respond.

1. Reported Jul 1, 2026

   Sysdig documented what it called the first ransomware campaign run end-to-end by an LLM agent, which broke into an internet-facing Langflow instance through CVE-2025-3248 and encrypted 1,342 service configuration items while deleting the… source

2. Response Jul 6, 2026 none

   No public response found from any model provider or from Langflow about this incident. Sysdig could not identify which model or provider the agent used and said it had 'no visibility into JADEPUFFER's system prompt or agent… source

3. Claimed fix Jul 1, 2026 partial

   There is no responsible party to issue a fix; the only remedy is the pre-existing vendor patch. The entry point, CVE-2025-3248, was fixed in Langflow 1.3.0 and added to CISA's Known Exploited Vulnerabilities catalog in May 2025 - the… source

4. Independent check Jul 20, 2026 partial

   No independent verification of Sysdig's 'LLM-driven' assessment was found; a Microsoft researcher speculated it ran on an open-weight model with safety training removed, which Sysdig neither confirmed nor ruled out. Rather than being… source

5. Where it stands Jul 20, 2026 reopened

   The same actor struck again through the same unpatched Langflow flaw weeks later with a new AI-model-wiping locker; there is no named responsible party, no model attribution, no arrest, and no public activity reported since July. source

The full case, with what would change the verdict →