MySecScan
Scan
News

An AI agent just ran a full ransomware attack on its own — but the way in was boring

Researchers documented JADEPUFFER, the first ransomware operation run end-to-end by an AI agent. The headline is the AI. The root cause is ordinary: an app left facing the internet with a known, already-patched flaw and no login required. The fix is the same as it's always been — know what of yours is exposed.

By Paul Rudenko, Security ResearcherJul 7, 20265 min read

What actually happened?

The Sysdig Threat Research Team published what it assesses to be the first documented case of agentic ransomware — a complete extortion operation driven start to finish by a large language model, not a human at a keyboard (Sysdig TRT, July 1, 2026).

The agent got in through an internet-facing Langflow server — an open-source tool for building AI apps — using CVE-2025-3248, a missing-authentication flaw that lets anyone who can reach the server run code on it. No password needed.

From there it acted like a fast, tireless operator: it enumerated the host, swept for API keys and cloud credentials, dumped a database, moved to a second exposed server, and finally encrypted and destroyed data before leaving a ransom note. Over 600 distinct payloads, one after another. At one point it went from a failed login to a working fix in 31 seconds.

Isn’t the scary part the AI?

That’s the part everyone’s writing about, and it is a real shift — the skill needed to run ransomware just dropped to “can you rent a model.” But look at how the agent got its foothold, because that’s the part that should change what you do on Monday.

CVE-2025-3248 was fixed in Langflow 1.3.0 and added to CISA’s Known Exploited Vulnerabilities catalog back in May 2025 (NVD entry). A patch and a public “this is being exploited” warning existed for over a year.

The AI didn’t find a new hole. It walked through an old one that was still open. The downstream target was worse: it fell to a 2021 authentication bypass and a default signing key that shipped unchanged. The novelty is the operator; the doors were all unlocked already.

So the honest takeaway isn’t “AI is coming for you.” It’s that AI makes the cost of trying every forgotten, exposed, unpatched system across the internet effectively zero — which means the long tail of things you’ve left facing the internet just got a lot more attractive.

For the site or business owner (plain English)

You probably don’t run Langflow. That’s not the point. The point is the shape of this attack, and it applies to any business:

  • Something was reachable from the open internet that didn’t need to be — an admin panel, a code-running endpoint, a database login. That’s what got probed first.
  • It was running old software with a known fix nobody installed. Not a zero-day. A patch that existed and was skipped.
  • Nobody was watching that corner, because it was a system someone stood up quickly and forgot.

Here’s the uncomfortable question this story asks every owner: do you actually know everything of yours that’s facing the internet right now? Most businesses can’t answer that with confidence — old staging sites, a dashboard a contractor set up, a service that was “temporary.” You can’t patch, lock down, or retire a system you’ve forgotten is exposed.

That’s what an external attack-surface scan is for: it looks at your domain from the outside, the way an attacker’s tooling does, and shows you what’s reachable — login pages, admin interfaces, services that were never meant to be public. It won’t tell you “you have CVE-2025-3248” — no honest external scan can name a specific flaw from the outside — but it will show you what’s exposed so you can decide what to close.

How do developers and IT respond to this one?

  • Patch Langflow to a release that fixes CVE-2025-3248 (1.3.0 or later), and never expose its code-execution or validation endpoints to the internet.
  • Get provider API keys and cloud credentials off web-reachable app servers. The agent’s first move was to sweep the host for OpenAI, Anthropic, AWS, GCP, and Azure secrets. Scope secrets to a manager, away from the process serving traffic.
  • Harden anything like Nacos or MinIO running with defaults: change default credentials and signing keys, and don’t let a service connect to its database as root.
  • Never expose a database admin account to the internet — enforce source-IP restrictions on management ports.
  • Apply egress controls so a compromised host can’t beacon out. The IoCs and full chain are in the Sysdig report.

What’s the real lesson here?

This is the same story we keep seeing, with a new narrator. An internet-exposed app, a known bug with a patch nobody applied, a well-worn config mistake — and something that industrialized the gap. Last time the something was a ransomware crew; this time it was an autonomous agent.

The specific tool never was the lesson. The forgotten thing facing the internet is. AI just makes forgetting more expensive, because the cost of finding your forgotten thing has dropped to nearly nothing. Shrinking what you expose is the move that actually breaks the pattern.

Frequently asked questions

Does this affect my business if I don't use Langflow?

Not directly — Langflow was just the unlocked door in this particular case. The pattern behind it affects everyone, though. The agent succeeded because some system was reachable from the public internet, running software with a known and already-patched flaw, with no one watching it. That describes an enormous number of forgotten assets across normal businesses: an old staging site, a dashboard a contractor spun up, a database left open “temporarily.” The specific product doesn't matter. What matters is whether you have things facing the internet that you've lost track of. If a tool can find and exploit forgotten systems at almost no cost, the safest position is to know exactly what of yours is exposed and to keep that list as short as it can be.

What is CVE-2025-3248, and should I be worried about it?

CVE-2025-3248 is a missing-authentication flaw in Langflow, an open-source framework for building AI applications. In plain terms, anyone who could reach an affected server over the internet could run their own code on it without logging in. It was fixed in Langflow version 1.3.0 and added to CISA's Known Exploited Vulnerabilities catalog in May 2025, meaning it was confirmed as being used in real attacks over a year ago. If your team runs Langflow, update it and make sure its endpoints aren't published to the open internet. If you don't run Langflow, this specific flaw isn't yours to fix — but the broader habit it exposed (leaving reachable services on old, unpatched software) is worth checking regardless of which products you use.

Should I be afraid of “AI-powered” attacks now?

Fear isn't the useful response — a change in priorities is. What AI agents change is economics, not the fundamentals. The techniques in this attack were all old and unsophisticated; the model just chained them together quickly and cheaply, and could do the same across thousands of targets without getting tired. That means the long tail of neglected, exposed systems that used to be too low-value for a human to bother with is now worth an automated attacker's time. Your defenses don't need to be exotic to hold up. The same fundamentals still work: reduce what you expose to the internet, keep what remains patched, use strong and unique credentials, and monitor for the unexpected. AI raises the volume of attempts; it doesn't rewrite what protects you.

How do I find out what of ours is exposed to the internet?

Start by asking a plain question internally: what systems of ours can be reached from outside our network, and does each one need to be? Many teams can't answer confidently, and that uncertainty is itself the finding. From there, an external attack-surface scan checks it from the outside — it looks at your domain the way an attacker's tools would and lists what's reachable, including login portals, admin panels, and services that were never meant to be public. It won't confirm a specific vulnerability like CVE-2025-3248 from the outside, and you should be wary of any tool that claims it can. What it does give you is an honest map of your exposure, so you can decide what to lock down, put behind a VPN, or shut off entirely — before someone else maps it for you.

Sources