For a while, the conversation about AI and cyberattacks has lived in the theoretical. LLMs can help write phishing emails. LLMs can help explain exploit code. LLMs could, in principle, automate parts of an attack. JadePuffer moves this conversation from could to did.
JadePuffer is the first documented ransomware operation conducted entirely by a large language model agent, with no human operator. The agent performed reconnaissance, credential theft, lateral movement, persistence, privilege escalation, and data encryption autonomously, and recovered from failures in real time.
How the attack worked
Initial access was via CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, the popular open-source framework for building LLM applications. CISA added CVE-2025-3248 to the KEV catalog in July 2026.
Once inside, the LLM agent did not wait for instructions. It began enumerating the environment, identified credential stores, moved laterally to other systems, established persistence, escalated privileges, and finally encrypted data. The sequence matches a full intrusion playbook that would have taken a human operator hours to execute manually.
The most notable detail: when the agent hit a failure, a failed login attempt at one stage, it did not stop. It analyzed the error, adjusted its approach, and succeeded. The time from failed login to working fix was 31 seconds.
What ENCFORGE targets
The ransomware payload deployed in this campaign, ENCFORGE, is compiled in Go and is designed specifically to encrypt AI infrastructure files. It targets:
- Model weights
- Vector indexes
- Training datasets
- AI infrastructure files across the host filesystem
This makes JadePuffer distinctly more damaging to AI-native organizations than traditional ransomware, which typically targets documents, databases, and backups. A compromised model weight or training dataset is not recoverable from a standard backup strategy unless you specifically back up AI artifacts separately.
What this changes
The distinction that mattered before JadePuffer was AI-assisted versus AI-autonomous. Assisted means a human operator uses an LLM as a tool to speed up parts of an attack. Autonomous means the LLM conducts the attack without a human directing each step. JadePuffer is in the second category.
This is not a theoretical proof of concept. It is a documented real-world operation. The attacker built an agentic system, pointed it at a target, and the system executed the full attack chain on its own.
The implication for defenders is direct: the time between vulnerability disclosure and active exploitation will continue to compress as autonomous agents can identify, exploit, and exfiltrate faster than human-paced patching cycles.
What to do
Patch Langflow if you are running it. CVE-2025-3248 should have been patched months ago, but given JadePuffer's existence, any exposed Langflow instance is a high-priority target. Check your internet-facing attack surface for any AI tooling that has not been patched recently. Back up AI model artifacts separately from standard backup targets. Review whether your incident response runbooks cover ransomware specifically targeting AI infrastructure.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to talk through your AI infrastructure security posture.