JadePuffer

What happened

Langflow is a visual builder for LLM workflows. Instances get stood up for a demo, left reachable, and forgotten. CVE-2025-3248 gave unauthenticated code execution against exposed instances.

What Sysdig documented as JadePuffer is among the earliest publicly recorded cases of ransomware where the operator work, enumeration, lateral movement, staging, encryption, was carried out by an LLM agent rather than typed by a person. The agent had a foothold, tools, and an objective, and it used them.

We do not call this a milestone. The mechanism is what matters: an exposed AI-infrastructure service with a known CVE, and an agent with enough autonomy to turn that foothold into a full intrusion without a human in the loop.

Why this surface is different

Langflow, Flowise, Dify, and their peers are AI infrastructure that no asset inventory calls infrastructure. They are installed by data or platform teams, frequently exposed for convenience, and patched rarely. The CVE was public and fixed well before the incident. The gap was knowing the instance existed.

Agent-executed intrusion also compresses the timeline. The window between foothold and impact is not bounded by an operator's working hours.

What a Sekeye campaign does

The template sweeps for the AI-infrastructure layer as installed software:

1. Agents report Python packages, container images, and service units across servers, the hosts where Langflow-class tooling actually runs, as well as laptops.
2. Version matching flags instances inside the CVE-2025-3248 range, with KEV and exploit-availability signals attached so it does not sit behind a queue of low-severity findings.
3. Blast radius per instance: what credentials the process environment names, what filesystem scope it holds, what it can reach.

Flight-recorder and rogue-behaviour signals belong to the Catch phase, which is on the roadmap and not yet shipped. Be clear about the boundary: the encryption payload is EDR's job. What is addressed here is the exposed, unpatched, uninventoried service that let the agent in.

Rotation guidance

Assume full compromise of the host and every credential its environment named. Rotate cloud roles, database credentials, and model-provider keys, then the service account. Treat backups as suspect until their integrity is verified independently of the affected host.

Confirmed against public reporting

Sysdig documented JadePuffer as an agentic threat actor: the attack capability was delivered by an AI agent rather than a human-driven toolkit. Initial access was CVE-2025-3248, an unauthenticated RCE in Langflow's /api/v1/validate/code endpoint affecting versions before 1.3.0, patched 1 April 2025 and added to CISA KEV the following month.

After code execution the agent dumped Langflow's PostgreSQL database, harvested environment variables and credentials, enumerated a MinIO object store, then pivoted to a production MySQL server running Alibaba Nacos, also exploiting CVE-2021-29441 to create rogue admin accounts. It encrypted 1,342 Nacos service configuration items before deleting the originals. In one recorded sequence it went from a failed login to a working fix in 31 seconds.