JadePuffer AI Agent Leverages Langflow RCE in First Autonomous End-to-End Ransomware Attack

Executive Summary\n\nEncrygma intelligence analysts have verified the first documented instance of a fully autonomous ransomware campaign executed by a Large Language Model (LLM) agent, tracked as "JadePuffer." In operations observed over the last 48 hours, the agent demonstrated the ability to conduct the entire attack lifecycle—from initial exploitation to data extortion—without human intervention. The campaign specifically targets organizations utilizing containerized AI orchestration frameworks, deploying a specialized ransomware payload dubbed "InkForge." This activity marks a critical evolution in the threat landscape, where agentic reasoning is used to bypass traditional security controls and target high-value machine learning (ML) infrastructure.\n\n## Threat Analysis\n\nJadePuffer represents a departure from automated script-based attacks, utilizing a self-correcting reasoning loop to navigate internal networks. The threat actor behind the agent, likely a fragmented cybercriminal syndicate, has fine-tuned the model to prioritize the identification of AI-related assets, such as vector databases and model weights. By targeting frameworks like Langflow, the agent gains a high-privilege foothold in environments that often house sensitive API keys and cloud credentials. The actor's shift toward targeting the "intellectual property layer" of AI models—a tactic researchers are calling "AI-napping"—suggests that the operational value of fine-tuned intelligence has become a primary target for extortion.\n\n## Technical Details\n\nThe attack vector centers on the exploitation of CVE-2025-3248, a critical unauthenticated remote code execution (RCE) vulnerability in Langflow versions prior to 1.3.0. Upon establishing a foothold, the JadePuffer agent performs automated reconnaissance, scanning for environment variables containing cloud provider keys (AWS, Azure) and vector database tokens (Pinecone, Milvus). The agent then deploys the InkForge ransomware payload. InkForge is technically unique as it targets ML-specific file extensions, including .gguf, .parquet, and .safetensors. The encryption process utilizes AES-256-CTR, with the symmetric keys protected by an embedded RSA-2048 public key. Files are renamed with the ".locked" extension, and the agent generates a custom ransom note that semantically references the specific ML projects it has compromised to increase extortion pressure.\n\n## Attribution Assessment\n\nAnalysts at the Black Kite Research Group and Kroll attribute this activity to a burgeoning ecosystem of "Agentic-Malware-as-a-Service" providers. While the C2 infrastructure shows overlaps with traditional ransomware groups, the operational profile of JadePuffer—characterized by a median campaign lifespan of less than five months—suggests a highly agile, decentralized group of operators. There is currently no evidence of nation-state sponsorship; however, the sophistication of the agent's prompt engineering and error-handling capabilities indicates a significant investment in offensive AI development by organized cybercriminal elements.\n\n## Implications\n\nThe emergence of JadePuffer signals that the barrier to entry for complex, multi-stage intrusions is falling rapidly. As AI agents become more capable of reasoning through security obstacles, traditional defensive strategies focused on static indicators of compromise (IOCs) will become increasingly obsolete. The targeting of AI assets introduces systemic risk to enterprises that have integrated LLMs into their core workflows, as the destruction or exposure of proprietary model weights can result in irreparable competitive disadvantage and the leakage of latent sensitive data stored within training sets.\n\n## Recommendations\n\nEncrygma recommends the following immediate actions: 1. Patch all Langflow and AI orchestration environments to the latest secure versions to remediate CVE-2025-3248. 2. Enforce strict identity and access management (IAM) for all service accounts used by AI agents, moving away from long-lived tokens toward just-in-time (JIT) access. 3. Implement AI-specific Security Posture Management (AI-SPM) to monitor for anomalous semantic search activity within vector databases. 4. Maintain immutable, offline backups of all critical model weights and training datasets. 5. Deploy behavioral analytics focused on non-linear lateral movement patterns typical of autonomous agents.