JadePuffer Ran a Complete Ransomware Chain. No Human Required.

The patch is not the story. The access model is.

On July 3, 2026, cloud security firm Sysdig published research on a threat actor they track as JadePuffer. What JadePuffer did was methodical: exploit CVE-2025-3248, a missing authentication flaw in Langflow rated CVSS 9.8, deploy an autonomous AI agent into the compromised environment, and let it run. The agent conducted reconnaissance. Harvested API keys, cloud credentials, and database passwords. Dumped a PostgreSQL database. Scanned the internal address space. Probed MinIO object storage. Established persistence via a cron job. Then pivoted to a production MySQL server and a Nacos service configuration platform, forged JWTs using Nacos’s default signing key, and encrypted 1,342 service configuration items before depositing a ransom demand.

No human directed individual steps. The AI ran the whole chain.

Here is what that actually means for your architecture: every AI agent in your environment is a pre-authorized attack tool waiting to be hijacked. The question is not whether this will happen to someone you know. It already has.

What CVE-2025-3248 Actually Enabled

CVE-2025-3248 is a missing authentication vulnerability in Langflow’s /api/v1/build/ endpoint. An unauthenticated attacker can reach it directly and execute arbitrary Python code on the server. The National Vulnerability Database rates it 9.8 on the CVSS 3.1 scale. CISA added it to the Known Exploited Vulnerabilities catalog in early May 2026 – two months before this attack was reported publicly. Every organization still running unpatched Langflow in July had been warned.

But the CVE is not why this incident matters.

Langflow is designed to connect AI reasoning capabilities to enterprise data systems. Its entire value proposition is that you can wire a large language model to your databases, your APIs, your cloud storage, your configuration management systems, and let it take autonomous action. When JadePuffer exploited CVE-2025-3248, they did not get a foothold. They got an operator – one with read/write access to everything the workflow had been authorized to touch.

The flaw in Langflow is fixable. The architectural question it exposes is not.

The Access Model Nobody Questioned

The JadePuffer agent moved from Langflow to PostgreSQL to MinIO to Nacos because those systems trusted it. Not because it bypassed authentication – in the Nacos phase, it exploited CVE-2021-29441 (a documented authentication bypass) and forged JWTs using a default signing key that organizations routinely leave unchanged. But the broader access model required no exploitation at all. The agent inherited the permissions of its deployment environment. Broad access to databases, storage, and configuration services had been granted to the workflow platform. When the workflow platform was compromised, those grants transferred to the attacker.

This is not a Langflow-specific problem.

Verizon’s 2025 Data Breach Investigations Report identified credentials as the leading attack vector across breach categories. The Kiteworks Data Security and Compliance Risk: 2026 Forecast Report documents the scale of the governance gap: most organizations deploying AI agents have not applied the access controls they apply to privileged human accounts.

Ask yourself: does your AI agent have a documented minimum access profile? Does it hold standing credentials to databases and configuration systems it only occasionally needs? Can it reach production environments directly, or does it go through a governed interface? Most honest answers to those questions are uncomfortable.

Why the AI Made It Worse

The LLM inside the JadePuffer workflow did something that distinguishes this attack from scripted automation: it adapted. When it encountered obstacles – login failures, locked endpoints, unexpected response formats – it corrected its approach in real time. Sysdig’s researchers observed it parsing free-text context presented by the target environment and taking actions that “only make sense if that text was read and understood, rather than pattern-matched by a scanner.” The LLM narrated its own targeting rationale in natural language. It checked for MySQL User Defined Functions that could enable OS command execution and adjusted its payload accordingly.

This matters for detection. Your behavioral anomaly tools are calibrated for human activity patterns and static script signatures. An AI agent executing a workflow generates structured, API-conformant traffic. It looks like normal system activity because at the protocol level, it is. The JadePuffer agent did not set off alarms because nothing in the traffic was technically anomalous – it was just wrong.

CrowdStrike’s 2026 Global Threat Report recorded a 29-minute average adversary breakout time – the interval between initial access and lateral movement. AI-enabled autonomous agents compress that window further still, because there is no human decision latency between steps. The attack chain that ended with 1,342 encrypted configuration items ran without pause.

The Architectural Question

The instinct after an attack like this is to patch faster and rotate credentials. Both are correct and neither is sufficient.

The JadePuffer attack succeeded because the target environment was built on implicit trust. Once the AI agent was running inside Langflow, it could reach everything Langflow could reach. That design decision – granting broad, standing access to a workflow platform – is more common than the security industry acknowledges. We have spent years telling developers to embrace AI agents as productivity multipliers. We have spent considerably less time telling them to treat those agents as privileged operators that require the same access governance as senior human accounts.

The architectural response is data-layer access controls: attribute-based policies that grant AI agents access to specific resources based on the attributes of the current request, not the broad identity of the system making it. A hijacked agent operating outside its intended task context fails attribute validation and stops. This is the zero-trust principle applied one layer deeper than most architectures currently reach – not at the network boundary, not at the application identity layer, but at the content layer, where data actually lives.

Platforms built on this model – like Kiteworks, which channels AI agent interactions through a governed interface that enforces authentication, authorization, and logging per request rather than per session – prevent exactly what happened in the JadePuffer chain: a compromised agent using standing authorization to move freely across connected systems.

What You Do Monday Morning

1. Audit AI agent access scopes now. Every agent in your environment should have a documented minimum access profile. Agents with standing credentials to databases, configuration systems, or object storage need those credentials scoped to the minimum required operations – not to the convenience of the deployment.

2. Check Langflow and Nacos patch status. CVE-2025-3248 and CVE-2021-29441 are both patched. There is no excuse for running unpatched instances. Extend that audit to every AI workflow framework and service configuration platform in your environment.

3. Rotate default credentials and signing keys. Nacos’s default JWT signing key is publicly documented. If you have not rotated it, you are one forged token away from the same attack. This applies to any service configuration platform or secrets management tool with a default credential.

4. Instrument AI agent behavior, not just AI agent output. What did the agent request? What did it receive? What endpoints did it call, in what sequence? If you cannot answer those questions from your current logging infrastructure, you cannot detect JadePuffer-style attacks before they complete.

5. Apply least privilege to AI agents the same way you apply it to service accounts. The JadePuffer attack chain ran because no one asked the question that stops this attack at step one: does this AI agent actually need access to production databases, object storage, and configuration vaults simultaneously?

The answer, in most cases, is no. The question just never got asked.