Sysdig reports what appears to be the first fully “agentic” ransomware operation, dubbed JadePuffer, conducted end-to-end by a large language model (LLM) agent rather than a human operator. The attacker exploited CVE-2025-3248, a critical unauthenticated RCE in Langflow, an open-source framework for building LLM apps, to gain code execution on an internet-exposed instance. Once in, the LLM-driven agent autonomously dumped Langflow’s Postgres database, harvested API keys, cloud credentials, wallets, and config files, scanned internal networks, probed MinIO, and set up persistence via a cron job. It then pivoted to a production MySQL server running Alibaba Nacos, abusing root credentials and multiple vectors, including CVE-2021-29441 and forged JWTs, to gain admin control. The agent encrypted 1,342 Nacos configuration items using MySQL’s AES_ENCRYPT(), dropped original tables, and created an extortion table with a ransom note, Bitcoin address, and Proton Mail contact. Payloads contained natural-language commentary and showed the LLM adapting in real time—fixing failed logins in seconds, adjusting to XML vs JSON responses, and narrating its logic. Notably, the randomly generated encryption key was never stored or sent, making recovery impossible, and the Bitcoin address appears lifted from public documentation, which was another signal of LLM behavior. This agentic operated JadePuffer demonstrates that capable models have the ability to be substitute for skilled humans, dramatically lowering the barrier to serious attacks against poorly secured, internet-facing infrastructure, while also creating new detection opportunities in LLM-generated code.