What happened Researchers at Sysdig have documented what they describe as the first fully autonomous ransomware attack driven end-to-end by a large language model (LLM). The campaign, dubbed JadePuffer, completed an entire ransomware operation without requiring human intervention during the attack. According to Sysdig, JadePuffer initially exploited CVE-2025-3248, a remote code execution vulnerability affecting Langflow, The post JadePuffer Signals a New Era of AI-Driven Ransomware appeared first on CISO Whisperer.

Security Boulevard is a leading cybersecurity news and information portal, offering articles, analysis, and insights on cybersecurity threats, vulnerabilities, and best practices. From the latest trends in cyber threats to expert commentary on security technologies and compliance frameworks, Security Boulevard provides resources for security professionals, IT leaders, and business executives seeking to protect their organizations from cyber attacks and data breaches.

Security Boulevard

Sysdig researchers have documented JadePuffer, described as the first fully autonomous LLM-driven ransomware campaign. The attack exploited CVE-2025-3248, a remote code execution vulnerability in Langflow, then moved laterally to a production server running MySQL and Alibaba Nacos. The AI agent autonomously enumerated and exfiltrated database contents, deleted the database, and left an extortion note — all without human intervention, dynamically retrying failed actions. Security experts note that while the techniques are familiar, their autonomous orchestration marks a significant evolution in ransomware. CISOs are advised to patch Langflow, audit AI infrastructure for exposed endpoints and credentials, and strengthen continuous monitoring.