Researchers Claim First Fully Agentic Ransomware: JadePuffer

Researchers at cloud security firm Sysdig have detailed what they describe as the first known case of agentic ransomware, naming the operation JadePuffer. According to reporting by Infosecurity Magazine, the firm released details on a ransomware campaign it claims was completely driven by a large language model. The campaign, dubbed JadePuffer, targeted an internet-facing Langflow instance by exploiting CVE-2025-3248, the reporting said. Attack capabilities were delivered by an agent rather than a human-driven toolkit, Sysdig research claimed, and the AI was capable of working autonomously, retrying failed steps within refined parameters. The findings appeared in an Infosecurity Magazine article dated 6 July 2026.