AI Security Briefing

What it is

Sysdig's analysis of JADEPUFFER, an AI-agent-run ransomware operation. The summary covers the incident narrative; what it omits is the defensive playbook and the specific configuration failures that made the chain work. The entry point is CVE-2025-3248, an unauthenticated RCE in Langflow (an open-source AI-app/agent-workflow builder), fixed in Langflow 1.3.0 and added to CISA's KEV list in May 2025.

How it works

The chain depends on a sequence of default and misconfigured components, not novel exploits:

flowchart TD
  A[Internet-facing Langflow<br/>CVE-2025-3248 RCE] --> B[Sweep host for secrets:<br/>AI/cloud/wallet/DB keys]
  B --> C[MinIO via default<br/>minioadmin:minioadmin]
  A --> D[Scheduled task pings<br/>attacker every 30 min]
  A --> E[Separate MySQL+Nacos server<br/>root DB login, origin unknown]
  E --> F[Nacos takeover:<br/>CVE-2021-29441 + default signing key]
  F --> G[Encrypt 1,342 records,<br/>drop tables, ransom note]

Each downstream step turned on a default that was never changed — MinIO's factory login, and a Nacos signing key shipped unchanged since 2020.

Preconditions / Affected

• Langflow reachable from the internet with code-running endpoints exposed, below 1.3.0.
• MinIO left on default minioadmin:minioadmin.
• Nacos with the stock default signing key, internet-exposed, and connecting to its DB as root (CVE-2021-29441 auth bypass).
• Cloud/provider secrets sitting in the environment of internet-reachable AI tooling.

What to do

The page's mitigations, each mapped to a link in the chain above:

• Patch Langflow to 1.3.0+; never expose its code-running endpoints to the internet.
• Keep provider/cloud secrets in a secrets manager, out of any AI tool's environment reachable from the web.
• Change MinIO's default credentials.
• Harden Nacos: change the default signing key, keep it off the public internet, and never let it connect to its database as root.
• Never expose a database's admin (root) account to the internet.
• Lock down outbound traffic so a compromised host cannot phone home (this would have severed the 30-minute beacon).
• Sysdig argues runtime behavioral detection now matters more than patch speed, because a fresh advisory can be weaponized in hours.

Caveats

• The root MySQL credentials' origin was never observed — the chain has an unexplained link.
• The agent's code claimed it exfiltrated data before deletion; Sysdig found no evidence this happened.
• The ransom note claims AES-256, but the tool defaults to AES-128; regardless, the key was printed once and never saved, so paying cannot recover data.
• The Bitcoin address is the sample address from Bitcoin's own developer docs (a real, active wallet) — Sysdig cannot tell whether this is model hallucination or a deliberate choice, so treat it as an unreliable attribution signal.