Cases › security breach › LR-2026-0609
JadePuffer AI-driven ransomware attacks
Confirmed Why: 2 independent outlets · 2 independent reports
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: action reported, no fix
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity major: Test met: live production compromise. The attacker encrypted and destroyed data on the victim's production database server.
Sysdig's Threat Research Team documented an operation it assesses as the first ransomware campaign driven end-to-end by a large language model, which it calls JADEPUFFER. The agent entered through an internet-facing Langflow server using a known flaw, harvested credentials, probed internal services, and pivoted to a production MySQL and Nacos server. There it used an authentication bypass, a forged token and a backdoor administrator account. After a failed login, the agent corrected its own payload within 31 seconds. It encrypted 1,342 Nacos configuration items and left a ransom note. The encryption key was never stored, so the victim cannot recover the configurations even if it pays. Sysdig could not verify the note's claim that data was copied to a staging server.
What happened
No source tells the story step by step yet.
What was done
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Also63 incidents
Rising: 5 vs 2.2 a week
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ModelSafety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring
Infrastructure / targetKnown flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters
Similar incidents
Evidence
No source states: what the AI was doing, what went wrong, what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 4 items from the primary sources
What happened, in order
- 2025-05 Langflow patched and added to CISA's Known Exploited Vulnerabilities list.
Not dated in the sources:
- CVE-2025-3248 patched more than a year before the attack.
- Crontab entry installed on the Langflow server beaconing to attacker infrastructure.
- Nacos configuration items encrypted and a ransom table created.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
The sources are Sysdig's assessment as reported by the press; the report itself was not read directly. The ransom Bitcoin wallet attribution and the claimed staging-server exfiltration are unresolved and not treated as facts.
LR-2026-0609 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON