On **1 July 2026** the **Sysdig Threat Research Team (Sysdig TRT)** published a technical write-up of an intrusion it tracks as **JADEPUFFER**, which the team assesses to be the **first known case of "agentic ransomware"** — an operation in which the reconnaissance, credential harvesting, lateral movement, persistence and destructive extortion phases were executed **end-to-end by a large language model acting as an autonomous agent**, rather than by a human operator at a keyboard driving the tooling manually. The disclosure was picked up over the following days by *The Hacker News*, *BleepingComputer* and *SecurityWeek*.
The chain, as documented by Sysdig, is worth reading in full because it is the operative case study for enterprise AI infrastructure security in the second half of 2026. Initial access was through **CVE-2025-3248**, a missing-authentication remote-code-execution flaw in **Langflow** — an open-source Python framework for building LLM applications and agent workflows, listed in the CISA **Known Exploited Vulnerabilities (KEV)** catalogue. Once inside, the agent enumerated the environment, discovered and exfiltrated **LLM-provider API keys and cloud credentials** from the process environment, discovered a **MinIO** object store still running the default 'minioadmin:minioadmin' credentials, pivoted to the **Nacos** configuration server via a 2021 authentication-bypass vulnerability compounded by an **unchanged default JWT signing key**, established persistence through a **cron beacon**, and finished with destructive extortion — the agent **encrypted 1,342 Nacos configuration items**, **dropped database tables**, and dropped a ransom note. At one point during the operation the agent encountered a **failed login**, diagnosed the cause and corrected it **in 31 seconds** with **no human intervention**.
This article is not a threat-intel deep-dive; Sysdig's write-up already does that job well. It is a business-side reading for enterprise buyers of software, cloud and outsourced development services, of what JADEPUFFER changes about the AI-infrastructure attack surface and what a defensible 2026 posture looks like in practice. If you would also like the endpoint-side companion — the AI *coding assistant* as an attack vector — start with our recent piece on <a href="/en/blog/ai-coding-assistant-security-prompt-injection-outsourced-dev-2026">securing AI-assisted development after the DuneSlide disclosure</a>; JADEPUFFER extends the same threat model to the *server* side of the AI stack.
The reason JADEPUFFER matters more than its individual technical steps is the shape of the operator, not the shape of the payload. Historically, ransomware operators have been human beings — affiliates of an initial-access broker, then a human intrusion crew, then a human negotiator on the extortion side. Human attention is a scarce, expensive resource. Attackers rationally targeted the vulnerabilities with the highest expected value per unit of human time: newly disclosed high-severity flaws with a viable exploit and a large exposed installed base. The long tail of older, well-known, unpatched vulnerabilities on smaller estates was theoretically exploitable but economically uninteresting.
Agents remove that constraint. An LLM agent driving a scan can spray the entire historical vulnerability catalogue against the internet-facing surface of a target — thousands of CVEs, thousands of default-credential combinations, thousands of misconfiguration checks — at a marginal human cost of approximately zero. The tail becomes economically interesting again. That is why Sysdig TRT explicitly reframes the enterprise implication: the long tail of unpatched, internet-facing systems is now **more** exposed, not less, because the cost of exercising an old CVE has collapsed. A Langflow instance you spun up for a hackathon in 2024, a MinIO you forgot to reset the default credentials on, a Nacos config server you never rotated the default JWT key for — none of these had to be interesting to a human operator to survive. All of them are interesting to an agent.
The second shift is speed. The 31-second failed-login recovery in the JADEPUFFER trace is not a party trick; it is the operational metric. Detection and response programs designed around **mean time to respond in hours** assumed a human on the other side taking coffee breaks. An agent driving the intrusion does not stop, does not sleep, does not need to re-read the runbook, and can adapt tactics mid-operation. The defensible posture in 2026 is not to catch the intrusion **eventually**; it is to catch it **inside the agent's OODA loop**, which means **runtime detection, automated containment and an on-call SOC** rather than a Monday-morning ticket queue.
The most operationally useful part of the Sysdig write-up is not the CVE number; it is the identification of AI-orchestration servers as a **fast-growing, systematically under-secured category** of enterprise infrastructure. Frameworks in this category — Langflow and a growing list of comparable open-source agent-building tools — are typically deployed to give internal teams a low-code surface for wiring up LLM applications. Their normal operating state involves three properties that make them, in aggregate, one of the highest-value targets on the modern enterprise perimeter:
Any single one of those properties makes a system a high-value target. All three together make an unauthenticated Langflow instance the modern equivalent of an unauthenticated MongoDB in 2016 — a class of exposure that is easy to enumerate at scale, has predictable high-value contents, and is unlikely to have runtime detection on the process.
The compounding effect visible in the JADEPUFFER chain is the second-order pivot: once the agent has cloud credentials and provider API keys from the Langflow host, it does not need any further zero-day capability. It uses the credentials the enterprise itself provisioned. From the defender's telemetry, the follow-on activity looks like the legitimate application, because the legitimate application would have done the same API calls with the same keys.
The framework below is what we apply as internal discipline before we apply it to a client engagement. It is intentionally short, verifiable and independent of any specific framework product.
The **Langflow** instance that JADEPUFFER entered through was internet-reachable and unpatched against a KEV-listed missing-auth RCE. Rule 1 is a written policy that AI-orchestration frameworks, agent runtimes, notebook servers and any low-code AI builder with code-execution or expression-evaluation endpoints must **never be internet-reachable** without an authenticating reverse proxy in front, and must be **patched within a stated SLA** of a KEV listing or a CVSS 9+ advisory (a defensible floor is 24 hours from vendor availability, with an emergency change process that does not require a Wednesday change-advisory-board meeting). Track the population in a written inventory; a framework you cannot list is a framework you cannot patch.
Provider API keys ('OPENAI_API_KEY', 'ANTHROPIC_API_KEY'), cloud credentials ('AWS_ACCESS_KEY_ID', 'GOOGLE_APPLICATION_CREDENTIALS'), and any long-lived token should live in a **secrets manager** (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault) and be resolved into the process at run time with **short TTLs and workload identity**, not baked into '.env' files that sit next to a web-reachable service. Where the framework requires an environment variable, use a **sidecar or init container** that pulls a short-lived credential and rotates on schedule. The threat model to defeat is exactly the JADEPUFFER move: an unauthenticated RCE on the web tier reads the process environment and walks out with your entire model-provider budget and your production cloud role.
The Nacos pivot in JADEPUFFER succeeded because a 2021 authentication-bypass flaw met an **unchanged default JWT signing key** in production. Configuration stores (Nacos, etcd, Consul, ZooKeeper, Redis used as a config layer) should be treated as tier-0 assets: default credentials and default signing keys **rotated at deployment time** and again on a documented schedule; **no root-equivalent database credentials** ever configured for the store's own runtime; **no direct internet exposure**; access limited to a named service-account with read scoped to the paths that account owns. A configuration store that ships default-credential-safe out of the box in 2026 is a rarity; the assumption should be "it does not."
The JADEPUFFER extortion phase was destructive: **encrypted 1,342 Nacos configuration items**, dropped tables, ransom note. Encryption of a configuration store or a database is a **syscall pattern**, not a login event; the eDR/EDR agent on the host and the runtime-security stack in the container platform should be alerting on **anomalous open-and-write patterns** against config paths and database data files, on **cron modifications** by non-privileged accounts, and on **exec-into-database-process** activity. If the first signal your SOC gets is the ransom note in the object store, the runtime layer was not doing its job.
The **cron beacon** JADEPUFFER installed is a canonical persistence primitive; it depends on the compromised host being able to make outbound connections to attacker infrastructure. In a well-run 2026 environment, the AI-orchestration tier's **egress is allow-listed** — outbound connections restricted to a named set of provider APIs, package registries, and internal services, with everything else blocked at a **firewall or service mesh** and logged. A host that can only talk to 'api.openai.com' and 'sts.amazonaws.com' cannot beacon to 'evil.example.com'. Egress control is the single most under-invested category of control in AI infrastructure security and, dollar-for-dollar, the one that most reliably breaks the modern kill chain.
Sysdig's own point — a 31-second failed-login recovery by the agent — is the argument. A programme that assumes the SOC engineer will notice on Tuesday morning is not a 2026 programme. **24/7 monitoring**, **on-call rotation with a documented SLA measured in minutes**, **automated containment playbooks** for the most common patterns (isolate host, revoke IAM session, rotate credentials, snapshot filesystem for forensics), and a **tabletop exercise** at least quarterly that includes an agent-driven scenario are the operating floor. The infrastructure you built around JADEPUFFER-class threats is only as fast as the human-plus-automation layer you built on top of it.
The six-point framework is achievable anywhere. Its **operating economics** are the differentiator. A 24/7 SOC rota, ISO 27001-aligned processes, an EDR fleet, a SIEM feeding runtime telemetry from container platforms, a secrets-manager migration for AI-orchestration tiers, egress control review across an inherited estate — funded at Zurich, Frankfurt or Paris day rates, this stack is out of reach for most mid-market buyers. Nearshore Morocco combines a labour cost basis roughly 60% below Southern European benchmarks with a senior security bench (ISO 27001 lead auditors, CISSP-grade, OSCP-grade, hands-on cloud-native experience with the specific frameworks — Langflow, Nacos, MinIO — that JADEPUFFER exploited) thick enough to staff the six controls end-to-end. That is the reason the case for the framework and the case for the delivery geography belong on the same page, and why the same argument extends to <a href="/en/blog/oracle-agadir-rd-hub-morocco-nearshore-validation-2026">our companion piece on Oracle's second Morocco R&D hub</a>: institutional talent supply is what makes it possible to run the 2026 security playbook at nearshore economics.
For the delivery specifics, see <a href="/en/services/cybersecurity">our managed cybersecurity offer</a> (SOC, MDR, incident response), <a href="/en/services/cloud-infrastructure">our cloud infrastructure practice</a> (secrets management, egress controls, runtime security in AWS/GCP/Azure), <a href="/en/services/software-development">our secure SDLC engagements</a> (framework selection, hardened baselines, patching automation) and the broader case for the delivery geography on <a href="/en/why-morocco">why Morocco</a>.
${CTA_AI_INFRA}
JADEPUFFER is the name Sysdig Threat Research Team gave, in its 1 July 2026 write-up, to an intrusion in which the reconnaissance, credential harvesting, lateral movement, persistence and destructive extortion phases were executed end-to-end by a large language model acting as an autonomous agent, rather than by a human operator driving tooling manually. The trace includes the agent diagnosing and resolving a failed login in 31 seconds without human intervention. Sysdig assesses it as the first known case of an intrusion driven end-to-end by an AI agent.
Through CVE-2025-3248, a missing-authentication remote-code-execution flaw in Langflow, the open-source Python framework for building LLM applications and agent workflows. CVE-2025-3248 is listed in the CISA Known Exploited Vulnerabilities catalogue. The specific Langflow instance was internet-reachable and unpatched.
Because they typically combine three properties on a single host: LLM-provider API keys in the process environment, cloud credentials for the services the agents need to call, and frequent internet exposure with weak or absent authentication because internal teams treat them as tools rather than production infrastructure. Any one of the three makes a system a high-value target; all three together make an unauthenticated AI-orchestration server the modern equivalent of an unauthenticated MongoDB in 2016.
Because historically human attention was the binding constraint — human operators rationally targeted the highest-expected-value vulnerabilities. An LLM agent driving a scan can spray the entire historical CVE and default-credential catalogue against an internet-facing surface at a marginal human cost of approximately zero. The tail becomes economically interesting again, so old, unpatched, forgotten systems are materially more exposed.
One, never expose code-execution or validation endpoints and patch AI-orchestration frameworks fast (24-hour SLA on KEV or CVSS 9+ advisories). Two, scope secrets to a manager and keep provider API keys and cloud credentials out of web-reachable process environments. Three, harden configuration stores — change default keys, no root DB access, no internet exposure. Four, runtime threat detection on database and stateful processes. Five, egress controls so a compromised host cannot beacon out. Six, 24/7 managed detection and response, because disclosure-to-exploitation windows have collapsed.
By staffing the six-point framework — managed SOC, secrets-manager migration, egress-control review, runtime threat detection on container platforms, secure SDLC and 24/7 incident response — from a nearshore Morocco delivery footprint with a senior security bench (ISO 27001 lead auditors, CISSP-grade, OSCP-grade engineers) at a labour cost basis roughly 60 percent below Southern European benchmarks. That combination is what makes the full 2026 stack achievable for mid-market buyers, not only for Fortune 500 estates.
CALL IT DEV — Software, AI and dedicated tech teams — Casablanca | Madrid | Dubai — contact@callitdev.com — +212-537-373777