{
 "public_id": "AIR-2026-0151",
 "incident_id": "2026-07-jadepuffer-agentic-ransomware",
 "date_disclosed": "2026-07-02",
 "date_occurred": "2026",
 "title": "JADEPUFFER: ransomware intrusion assessed to have been executed end-to-end by an LLM agent via Langflow RCE",
 "class": "in_the_wild",
 "attack_surface": "agent_framework",
 "initial_vector": "exploitation_of_exposed_langflow_cve_2025_3248",
 "agent_capability_abused": [
  "code_execution",
  "autonomous_task_decomposition",
  "credential_harvesting",
  "lateral_movement",
  "data_destruction",
  "autonomous_recon",
  "database_destruction",
  "ransom_negotiation"
 ],
 "target_product": "Langflow (initial access), MinIO, MySQL, Alibaba Nacos",
 "target_vendor": "Langflow / victim-operated",
 "autonomy_level": "fully_autonomous",
 "impact_realized": true,
 "impact_type": [
  "ransomware",
  "data_destruction",
  "credential_theft",
  "extortion",
  "business_disruption"
 ],
 "blast_radius": "One victim environment; 1,342 Nacos configuration items encrypted and multiple databases dropped, unrecoverable",
 "cve": [
  "CVE-2025-3248"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "agentic_ransomware",
   "ai_infrastructure_as_entry_point",
   "self_narrating_payloads",
   "agentic_threat_actor",
   "first_of_kind",
   "llm_driven_end_to_end"
  ]
 },
 "defense_present": "none effective",
 "defense_bypassed": true,
 "fix_shipped": "CVE-2025-3248 fixed in Langflow 1.3.0; added to CISA KEV in May 2025",
 "primary_sources": [
  "https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion",
  "https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html",
  "https://incidentdatabase.ai/cite/1578"
 ],
 "verified_quote": "All 1,342 configuration items have been encrypted",
 "confidence": "high",
 "notes": "Sysdig's 'first ransomware run start to finish by an AI agent' framing is inference, not proof: they never observed the model or agent framework. Their evidence is behavioural - self-narrating payloads, a 31-second failure-diagnosis-and-correction cycle, semantic parsing of free-text environment data, and a ransom Bitcoin address (3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy) that is the canonical documentation example address, which may be an LLM hallucination. Sysdig themselves flag that exfiltration is claimed only in the agent's own code comments and was not independently observed. Note the irony that the entry point was an AI agent-builder platform. | Merged from duplicate id `2026-07-sysdig-jadepuffer`. Also reported as: 'JADEPUFFER: an end-to-end LLM-driven ransomware operation that extorted a production database'.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Credential & Secret Theft",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape",
  "Over-permissioned execution & lateral movement",
  "Ransomware & Extortion"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "the LLM agent is assessed to have executed the intrusion end to end",
 "vector_family": "conventional_vulnerability",
 "vector_detail": "exploitation_of_exposed_langflow_cve_2025_3248",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [
   1578
  ],
  "atlas": [],
  "cve": [
   "CVE-2025-3248"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "langflow",
 "model_provider": "alibaba",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "credential_theft",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "unsafe_actuation"
 ],
 "eai_reason": "subcategory: Credential & Secret Theft",
 "asi_curated": [
  "ASI05"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI05 | added ASI03 (eai_category=credential_theft)",
 "submitted_by": "EAI Internal"
}