Sysdig's threat research team published a detailed breakdown of JADEPUFFER, an agentic AI system that executed a complete ransomware campaign with no human operator involvement after initial target selection.

The attack chain: CVE-2025-3248 (Langflow RCE) for initial access, credential harvesting across LLM providers and cloud platforms, MinIO default credential exploitation, then lateral movement to a Nacos configuration server via CVE-2021-29441 (auth bypass) and JWT forgery using the well-known default signing key.

The interesting part is the self-correction behavior. When a bcrypt hash generation failed due to a PATH issue in the container, the agent diagnosed the failure, generated two hypotheses, tested both, and deployed a fix in 31 seconds. Sysdig's telemetry timeline shows the full correction chain.

Then it got worse. CSA documented ENCFORGE, a JADEPUFFER variant that specifically targets ML model files (.safetensors, .gguf, .pt, .faiss, .parquet). Destruction-first ransomware. No leak site. Leverage comes from model reconstruction costs ($75K-$500K per model).

Wrote up the full attack chain, the autonomous behavior markers, and practical defenses for self-hosted AI infrastructure:

https://medium.com/@neonmaxima/jadepuffer-is-the-first-autonomous-ai-ransomware-encforge-makes-it-worse-dcb569a11502