The End of Human-Speed Cyber Operations
How agents chained ordinary vulnerabilities into an end-to-end ransomware operation—fully autonomous.
JadePuffer is a small case study for a larger shift. It does not show that AI has made cyber operations sophisticated. It shows something more practical: parts of the operational loop are becoming less dependent on human operators.
The lesson is not that JadePuffer was advanced. The lesson is that it did not need to be.
For the most part, this was the first documented case of agentic ransomware, and the operation itself was almost entirely ordinary. That combination is the story. Not a new exploit, not a novel cryptographic trick, not elite tradecraft—a large language model chained together a run of well-understood techniques against neglected internet-facing infrastructure and carried the operation from initial access to destruction without a human continuously driving the keyboard. Sysdig’s Threat Research Team named the operator JadePuffer and assessed it as the first extortion campaign run end-to-end by an LLM. What made it notable was not what the agent did. It was that the agent did it.
What it actually did
The operation touched two machines. The first was an internet-facing instance of Langflow, an open-source framework for building LLM applications and agent workflows. The agent gained access through CVE-2025-3248, an unauthenticated remote-code-execution flaw in Langflow’s code-validation endpoint. It’s a CWE-306 missing-authentication issue that lets anyone who can reach the server run arbitrary Python on it. NVD rates it 9.8. The vendor shipped a fix in Langflow 1.3.0 in April 2025, and CISA added it to the Known Exploited Vulnerabilities catalog the following month. The target was never updated. Every payload in the campaign arrived as Base64-encoded Python through that one endpoint.
Once it had execution, the agent behaved the way a competent operator would, only compressed. It enumerated the host with id, uname -a, hostname, and network and process listings. It swept the environment for secrets in parallel: LLM provider API keys, cloud credentials with explicit coverage of Chinese providers like Alibaba, Tencent, and Huawei, cryptocurrency wallets and seed phrases, and database credentials. It dumped Langflow’s backing PostgreSQL database to harvest stored secrets, staged the output to files, reviewed them, then deleted the staging files. It found a MinIO object store still running factory-default credentials—minioadmin:minioadmin—and authenticated to it. Before leaving, it installed a cron job on the Langflow host that beaconed to attacker infrastructure every thirty minutes.
Then it pivoted to the real objective: a separate internet-exposed production server running MySQL and Alibaba’s Nacos configuration service. It connected to MySQL as root, using credentials whose origin Sysdig could not determine and which were not harvested from the victim environment. It attacked Nacos through several vectors at once—the documented 2021 authentication bypass CVE-2021-29441, plus a forged JWT built from the default signing key that Nacos has shipped unchanged since 2020, which makes token forgery trivial—and planted a backdoor admin account. Two moments in this phase are worth pausing on, because they are the clearest evidence that a model was reasoning rather than replaying a script. In one, it tried to create the Nacos admin with a generated bcrypt hash, checked the login, saw it fail, diagnosed the cause, and issued a corrected payload thirty-one seconds later. In another, it expected JSON from an endpoint, received XML instead, and rewrote its own parser on the fly to handle it.
The impact was destruction wearing extortion’s clothes. The agent encrypted all 1,342 Nacos service configuration items and destroyed the originals, deleted whole databases, and left a ransom demand with a Bitcoin address and a Proton Mail contact. The encryption key was ephemeral and unrecoverable—generated at random, never saved or transmitted—so the victim’s configurations cannot be restored even with payment. The Bitcoin address was the exact sample wallet that appears throughout Bitcoin’s own developer documentation, which Sysdig could not definitively attribute to either a hallucination from training data or a deliberately chosen wallet. The agent also made false assertions in its own narration that defenders should not take at face value.
None of this was novel
Walk back through it and the striking thing is how routine each step was.
The entry point was a year-old vulnerability with a patch and a KEV listing. The object store used credentials that ship in the box. The database accepted a root connection from the open internet. The configuration service fell to a four-year-old bypass and a signing key that has been public since 2020. As Keeper Security’s CISO put it to SC Media, every entry point traces back to the same failure of credential governance: secrets stored where they should not be, defaults left unchanged, privileged accounts open with no time-bound or scope-limited controls.
What the sequence describes is a fairly standard security assessment—recon, credential harvesting, lateral movement, persistence, impact—run against a target that had left the usual doors open. It’s the same playbook a competent pentester works through. The only difference is that here the operator was an agent, assembling ordinary components, with no human present for any single step of it.
That is the part worth taking seriously. Not that a machine can do something people cannot. That a machine can now do the routine, unglamorous work of intrusion at full tempo, unattended. Sysdig’s own director of threat research made the same point: none of the individual techniques were novel, but an AI model strung them together into a complete operation against neglected infrastructure.
The economics that used to protect you are gone
Security programs have quietly relied on one assumption for a long time: that adversaries face the same scarcity defenders do. There are always more exposed services, stale CVEs, default credentials, overprivileged identities, and forgotten databases than anyone can fix. The bet was that attackers had to triage that backlog too, because exploiting it cost skilled operator time, and skilled operator time is expensive.
The numbers on the defensive side show how thin the margin already was before agents entered the picture. Critical-severity vulnerabilities take, by industry measurement, weeks to remediate on average—Edgescan's 2026 report puts mean time to remediate for high and critical application vulnerabilities at nearly 55 days, with device and network findings averaging 39 days. For larger enterprises with over a thousand employees, 37% of vulnerabilities discovered in a twelve-month period remain unresolved entirely. CISA's binding directive gives federal agencies 14 days to fix known-exploited vulnerabilities, and that ceiling is one many organizations miss. JadePuffer's own entry point had been on CISA's KEV list since May 2025, more than a year before the campaign. The remediation clock for the defender runs in weeks and months.
Now set that against the attack clock. CrowdStrike’s Global Threat Report puts the average eCrime breakout time—the interval between initial access and the first lateral move—in the tens of minutes, with the fastest observed breakouts measured in seconds. CrowdStrike’s own analysts have said it is only a matter of time before the fastest attacks are measured in seconds, if not milliseconds. And that clock starts even earlier than an intrusion. The Zero Day Clock, which tracks time-to-exploit across more than 83,000 CVEs, frames the broader trend bluntly: the gap between a vulnerability being disclosed and being exploited is collapsing toward zero. The window in which a known bug is theoretically patchable but not yet weaponized is the window defenders have always relied on, and it is closing from both ends.
A defensive process measured in weeks is not losing narrowly to an offensive process measured in minutes. It is operating in a different unit. Agents change the economics of the backlog precisely because they remove the labor constraint from the attacker’s side of that comparison. The long tail of boring, exploitable weakness—the stuff every organization carries because it was never worth an operator’s afternoon—becomes worth attacking when the operator is a process that does not get tired, does not get bored, and can spray the entire back catalogue of known bugs for the cost of running an agent.
Human-speed response cannot close that gap
Follow the tempo argument to where it lands and the conclusion is uncomfortable. When an agent goes from failed login to working fix in thirty-one seconds, or rewrites its own parser mid-operation when a response format surprises it, the loop of noticing, deciding, and intervening no longer fits a human in the middle. Daily alert triage and post-incident forensics are built around an adversary who pauses, thinks, and works at human speed. That adversary is being replaced by one that adapts inside the window a SOC analyst needs just to read the first alert.
The familiar controls still matter and still come first. Patch Langflow and never expose a code-execution endpoint to the internet. Change MinIO and Nacos defaults, rotate the Nacos signing key, keep provider keys and cloud credentials out of the environment of any internet-reachable server, never let a service reach its database as root, and keep immutable, tested backups—which in JadePuffer’s case were the only viable recovery path at all. But those are hygiene. They shrink the surface; they do not change the clock.
Closing the clock means moving response closer to runtime, where a malicious session can be interrupted mid-operation, a harvested credential can be revoked before it is used again, egress can be cut before a host phones home, and blast radius is bounded by design rather than by regret. When an adversary is trying to break into your company at machine speed, the facilities that detect, understand, and respond have to be able to keep pace, and a human reading a dashboard is not that facility.
There is a harder implication underneath, and it is the one worth ending on. The reason this matters is not only that response is too slow. It is that the knowledge defenders produce about their own systems is decaying faster than they produce it. A scan, an assessment, a pentest, a report—each is a snapshot of how a system could be attacked at one moment. That snapshot was already going stale as environments changed underneath it. Agentic operations accelerate the decay from both directions: the environment keeps shifting, and the cost of an adversary re-probing it keeps falling. The half-life of security knowledge is getting shorter.
Which reframes what security work has to be. What mattered yesterday was whether a system passed an assessment. What matters now is whether an organization can keep an accurate, current picture of how it can be attacked—at the same level of persistence an adversary brings, and produced by machinery that runs continuously rather than on a quarterly cadence. If the people trying to get in never stop looking, the people defending cannot afford for their understanding to be a document with a date on it.
JadePuffer is not a story about a superintelligent attacker. There wasn’t one, and there didn’t need to be. Pulling this off took nothing at the frontier—no reasoning breakthrough, no capability that only the largest models have. It took something just capable enough to follow a sequence of instructions, recover when a step failed, and keep moving faster than a person could respond. That is a much lower bar, and a much larger pool of systems clears it. Ordinary weakness becomes a different class of risk when the labor to find, chain, and exploit it becomes cheap. And the assurance we buy from point-in-time testing has a half-life measured against an adversary who no longer keeps human hours.
Indicators of compromise
For defenders checking exposure, Sysdig’s published indicators:
Entry point: CVE-2025-3248 (Langflow unauthenticated RCE)
C2:
45.131.66[.]106, beacon tohxxp://45.131.66[.]106:4444/beaconevery 30 minutesRansom BTC address:
3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy(note: this is the canonical example address from Bitcoin’s own documentation—treat as a weak indicator)Contact:
e78393397[@]proton[.]meRansom artifact: a
README_RANSOMtable written into the compromised database