Thirty-one seconds.
That's the number everyone has latched onto. On 1 July, Sysdig's Threat Research Team published its analysis of an operation it tracks as JADEPUFFER: an extortion campaign it assesses was driven end-to-end by a large language model. Partway through, the agent inserted a backdoor admin account into a Nacos configuration server. The login failed. Thirty-one seconds later (no human involved) it had diagnosed the cause as a PATH problem preventing bcrypt from generating a valid hash, rewritten its approach to import the library directly, deleted the broken account, and reinserted it correctly. Then it logged in.
Every write-up since has led with that number. Fair enough. It's a good number.
It's also the least useful thing in the report.
What actually happened
The agent got in through an internet-facing Langflow instance via CVE-2025-3248, a missing-authentication flaw in the code validation endpoint that lets an unauthenticated attacker run arbitrary Python on the host. From there it enumerated the box, swept the environment for provider API keys and cloud credentials, dumped Langflow's own Postgres database, and found a MinIO object store answering on the default minioadmin:minioadmin credentials. It listed the buckets (application data, backups, ML artifacts, a terraform-state bucket) and pulled credentials.json and .env out by name. Then it dropped a cron entry beaconing to its C2 every thirty minutes.
The real target was a different machine: an internet-exposed production server running MySQL and Alibaba's Nacos. The agent attacked Nacos through the CVE-2021-29441 auth-bypass family and by forging a JWT with the default signing key, which has been publicly documented since 2020 and still ships unchanged in plenty of deployments. It encrypted 1,342 configuration items with MySQL's AES_ENCRYPT(), dropped the original config and history tables, and created a table called README_RANSOM with a Bitcoin address and a Proton Mail contact.
Over 600 distinct payloads. Most of them narrating their own reasoning in plain English, because that's what LLM-generated code does by default.
Read that list again and find the sophisticated part. I'll wait.
A 2025 CVE on a server that shouldn't have been on the internet. Default object-store credentials. A five-year-old auth bypass. A signing key published in the documentation. A database admin account reachable from the open internet. Sysdig says it plainly: none of the individual techniques were novel or sophisticated.
Two things worth correcting before you repost this
First, the autonomy is real but bounded. TechCrunch went back to Sysdig's Michael Clark and got the qualifiers on record: a human provisioned the infrastructure, chose the target, and supplied the root database credentials. Sysdig never observed those being harvested. Sysdig also can't identify which model was driving it and has no visibility into the system prompt. The OpenAI, Anthropic, DeepSeek and Gemini keys the agent grabbed were loot, not evidence of what was behind the wheel.
If you're going to talk about this in front of clients, get that right. The story is "the expensive parts of an attack are now free," not "the machines have risen." One of those is defensible on a Tuesday morning.
Second, and this is the detail that should actually reach your board: the victim cannot get their data back. The AES key was generated from two random UUIDs, printed once to stdout, and never stored or transmitted anywhere. Paying does nothing. There is no key to buy. Meanwhile the agent's claim that it had exfiltrated the data first was just a comment it wrote in its own code, which Sysdig couldn't independently verify. And the Bitcoin address in the note is the canonical example address from Bitcoin's own developer documentation, sitting in every training corpus on earth.
An extortion operation where the demand may have been hallucinated and the decryption key was thrown away thirty seconds after it was made. Whatever this is, it isn't a negotiation.
The economics changed, not the attack
Here's my actual read, and it has nothing to do with 31 seconds.
Target selection used to be a budget line. A human operator working a keyboard had to decide whether you were worth an afternoon. A fourteen-person firm in Adelaide, or a manufacturer in Wingfield with one exposed box and an IT provider who visits on Thursdays. You were never worth the afternoon. Not because you were secure. Because you were beneath the labour cost.
That was the only thing protecting most Australian SMBs, and nobody ever said it out loud.
Sysdig's own conclusion is that the skill floor for running ransomware has now dropped to whatever it costs to run an agent, and if the agent runs on credentials stolen from someone else's LLM account, that cost approaches zero. Which means the historical vulnerability catalogue can now be sprayed across the entire internet for free. The long tail of neglected, unpatched, internet-facing infrastructure doesn't get safer as attackers get more sophisticated. It gets more exposed, because sophistication was never the constraint. Attention was.
You were protected by nobody bothering. Nobody has to bother anymore.
The uncomfortable bit for anyone running an AI pilot
Look at the entry point again. Langflow. A framework for building LLM applications and agent workflows.
Sysdig is explicit about why boxes like this are attractive: they're AI-adjacent, they frequently hold provider API keys and cloud credentials right there in the environment, and they get stood up quickly without network controls.
Read that as a description of your firm's AI pilot, because it probably is one. Someone spun up a workflow tool to test document extraction. It went in fast, because the point was to move fast. It's got an OpenAI key in a .env file, an S3 credential so it can read client documents, and it never went through whatever passes for your change process, because it was only an experiment.
That box is now the most attractive thing you own. It sits on the internet, it holds the keys to everything else, and it was built by people who were explicitly told not to worry about the infrastructure yet.
The AI tooling is the attack surface. Not the AI.
What I'd do this month
Not a checklist. Four questions I'd want answered before I stopped thinking about it.
Which AI-adjacent servers do you have on the internet, and who put them there? If the answer takes more than a day to produce, that's the finding. Shadow AI infrastructure is the 2026 version of the rogue Dropbox account, except it holds cloud credentials.
Are your provider keys and cloud credentials sitting in the environment of a web-reachable process? Sysdig's recommendation is blunt: don't run AI orchestration servers with credentials in their environment. Scope them to a secrets manager, away from anything the internet can reach.
Can a compromised application host beacon anywhere it likes? The cron job phoned home every thirty minutes for as long as it wanted. Egress controls are unglamorous and they would have broken this chain.
What's your answer when there's no key to buy? Australia's Cyber Security Act 2024 already requires ransomware payment reporting from entities above $3 million turnover, and firms spend an enormous amount of energy on the pay/don't-pay question. JADEPUFFER makes that question irrelevant. Your backups either work or your configuration is gone. The ASD's most recent Annual Cyber Threat Report puts the average self-reported cost of a cybercrime incident for an Australian small business at $56,600, up 14% year on year, and that's direct costs only, before the clients who leave. We cover the broader threat picture for Australian small businesses in more detail here.
The line I keep coming back to
An LLM narrates its own objectives. Sysdig's payload analysis is full of the agent explaining, in English, in comments, which databases it considered high-ROI and why it was dropping the largest one first.
Attackers have never done defenders that courtesy before. It won't last. The next operator will tell their agent to shut up. But right now, intent is legible in the artifacts, and that's a detection opportunity that didn't exist eighteen months ago.
I don't think JADEPUFFER is the story. I think JADEPUFFER is a fairly ordinary attack that got written up because a machine ran it. The story is that a 2021 CVE and a default password were still sitting there in 2026, waiting, and that from now on somebody will always have the time to come and find them.
If you want a second opinion on your AI infrastructure exposure or backup posture, we can help.
Sources
- JADEPUFFER: Agentic ransomware for automated database extortion, Sysdig Threat Research Team, 1 July 2026
- The 'first' AI-run ransomware attack still needed a human, TechCrunch, 6 July 2026
- AI Ransomware Is Here, Now Powered By Cheaper, Agentic Models, Forbes, 10 July 2026
- CVE-2025-3248 (Langflow), NVD
- CVE-2021-29441 (Nacos), NVD
- ASD Annual Cyber Threat Report 2024-25, small business incident cost via Tecnic Group
