JadePuffer: the first case of a full-fledged autonomous cyber attack using agent AI

Sysdig researchers have officially confirmed the first known case where an agent based on a large language model (LLM) was able to independently execute a complete cycle of a cyberattack. The malicious ransomware, called JadePuffer, worked autonomously, eliminating the need for human involvement in the management process.

During the attack, the AI ​​​​agent performed system reconnaissance, successfully stole credentials, secured a foothold in a compromised environment, elevated its privileges, and eventually encrypted the victim’s files.

Attack vector and technical details

The JadePuffer penetration began with the exploitation of the critical vulnerability CVE-2025-3248 in the Langflow platform, which is widely used by developers to build AI-based applications.

Results of automated hacking

• System information collection and credential search are automated.
• Unauthorized access to linked servers.
• Successful attack on Alibaba Nacos server.
• Encryption of 1342 configuration records.

Features of agent AI work

The main difference between JadePuffer and traditional malware is a high level of autonomy and adaptability. If the execution of a certain command led to an error, the agent did not stop work, but independently analyzed the situation, adjusted its actions and continued the attack. One of the clear examples is bypassing the authentication system in just 31 seconds.

Sysdig experts also noted unique artifacts in the generated code. The agent left comments in natural language that explained in detail the logic of the actions taken.

Code errors as a result of using LLM

Despite the technical complexity of the attack, the researchers emphasized the errors inherent in the work of current models. For example, the attacker used a test wallet, which is often found in training documentation, and instead of the claimed AES-256, the weaker encryption algorithm AES-128-ECB was actually used.

The future of cyber security

Experts warn that the use of such agents can significantly lower the entry threshold for cybercriminals, allowing for the automation of complex attack chains. However, there are still predictable traces (patterns) in the operation of current LLMs that allow modern monitoring systems to detect such threats. The expert community calls for more attention to be paid to the protection of environments using LLM development tools.