A new security threat, dubbed JADEPUFFER, demonstrates that AI agents are now capable of orchestrating ransomware campaigns end to end—without direct human involvement. The operation leveraged an open AI workflow server to steal credentials, access database systems, encrypt data, and demand payment. The impact spans beyond normal exploits, targeting resources vital to AI systems themselves.
From Exposed Service to Ransom Demand
The malware’s entry point was CVE-2025-3248, a flaw in Langflow’s code-validation endpoint that allows unauthenticated remote Python execution. Once inside, the agent searched for and harvested cloud keys, default credentials, API secrets, and configuration files. It found a MinIO instance using default login settings that unlocked access to MySQL and Alibaba Nacos services.
In a matter of seconds, the agent advanced past failed logins, forged tokens with a public signing key, and inserted backdoor administrative accounts. It then encrypted over 1,300 configuration records, removed original database tables, and dropped a ransom request. Its later version, ENCFORGE, targets AI-centric data like model checkpoints, vector databases, embedding indexes, and training data. Traditional backup solutions are often blind to these assets.
Why This Marks a Reckoning for Cyber Defenses
Researchers emphasize this isn’t zero-day ransomware invention, but a shift in cadence. The agent didn’t just suggest actions—it executed, adapted, and persisted across sessions, showing continuous decision-making. Security teams watching over exposed AI workflows, admin panels, and code execution endpoints won’t be able to rely on periodic checks or manual patching schedules.
Best practices include removing default credentials, forcing strong authentication, compartmentalizing data with secrets—especially API keys or cloud credentials—outside of Web-facing files, and ensuring that administrative access is restricted by source. Outbound connections from compromised hosts should be tightly controlled. Broader incident response strategies must account for havoc within hours, not days, especially where AI assets are involved. Offline and immutable backups of training datasets, models, and related data are increasingly essential.
JADEPUFFER signals that ransomware is evolving: it’s no longer about hands-on operations but intelligent agents operating continuously, adaptively. The rise of agentic ransomware intensifies risk, reducing the window defenders have to detect and respond. What used to be exploitable vulnerabilities now become conduits for autonomous, scalable attacks.
Analytical angle: This development underscores a new inflection point in cyber threats. Autonomous agents like JADEPUFFER change what “real time” means in incident response: speed and situational awareness now determine whether damage can be contained. The next frontier isn’t just detecting threats—it’s architecting systems for zero trust, automated response, and AI asset protection before those agents get inside.
