Sysdig documented JADEPUFFER on 2026-07-01 as an LLM-assisted ransomware campaign against internet-exposed Langflow servers. The entry point is CVE-2025-3248: the attacker delivers Base64-encoded Python through Langflow's unauthenticated code-validation endpoint. The first phase converts the AI workflow host into a credential and service map — enumerating host, process, network and environment context, dumping Langflow backing data, probing MinIO with default credentials, fetching credentials.json and .env, and installing a cron beacon. The campaign's actual objective was a separate Nacos/MySQL estate: Sysdig observed the agent connecting to an exposed MySQL instance as root with credentials whose origin was not observed, attacking Nacos auth-bypass and default-token paths, and inserting a backdoor administrator. The payload then encrypted 1,342 Nacos configuration items into backup tables, dropped the original configuration and history tables, wrote README_RANSOM, and dropped whole database schemas with retry logic; the agentic element compressed response time, repairing a failed Nacos admin creation within 31 seconds with no human at the keyboard.
ASSESSED SYSTEM
The victim-side internet-exposed Langflow LLM-workflow deployment observed in the JADEPUFFER campaign Sysdig published on 2026-07-01 — an unpatched Langflow server vulnerable to CVE-2025-3248 with an unauthenticated code-validation endpoint, its mounted secrets (credentials.json, .env, provider and object-store keys), and its unrestricted network reach to MinIO, Nacos and MySQL, in the configuration that existed at the moment of compromise.
OUT OF SCOPE
The attacker's own LLM-assisted tooling is explicitly NOT the assessed system — JADEPUFFER is agentic on the offence side, and scoring the attacker's autonomy would be a category error. Also out of scope: Langflow as a project and its patched releases; Nacos, MySQL and MinIO as products (they appear here only as reachable downstream nodes in the victim's estate); and Sysdig's detection platform.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 is NO — no inter-agent topology is documented on the victim side. Q2 is YES: Langflow is a visual framework for building and executing multi-step LLM workflows that maintain task state and invoke tool and code nodes without explicit human approval for each action, and the specific surface exploited was its code-validation endpoint, a dynamic-code execution path in the workflow runtime. The deployment also held provider credentials and object-store keys, confirming connector authority in the runtime. Tier 1: Tier 1 Critical — the brief's own conclusion sets the classification: "A Langflow server is not just a lab tool once it has secrets, network reach, and production data paths. Treat it like a production control-plane asset." The deployment held credentials and network reach into the production configuration control plane (Nacos) and databases, and the realised failure encrypted 1,342 Nacos configuration items and dropped whole database schemas — immediate operational and financial harm at scale for every dependent service.
Documented attack or failure path
- Discover an internet-facing Langflow code-validation endpoint by outside-in scanning (the exposure was unauthenticated and, per the brief's inventory guidance, not reconciled to an owner or exposure intent).
- Exploit CVE-2025-3248 by delivering Base64-encoded Python to the unauthenticated code-validation endpoint, obtaining arbitrary execution inside the AI workflow runtime with filesystem, network, import and shell capability.
- Enumerate host, process, network and environment context; dump Langflow backing data; fetch credentials.json and .env; probe MinIO with default credentials; install a cron beacon for persistence and callback.
- Pivot across the flat internal network to the real target: connect to exposed MySQL as root, and attack Nacos auth-bypass and default-token paths.
- Insert a backdoor administrator in Nacos — the agent repaired a failed admin-creation attempt within 31 seconds without human intervention.
- Encrypt 1,342 Nacos configuration items into backup tables, drop the original configuration and history tables, write README_RANSOM, and drop whole database schemas with retry logic.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Runtime detection and forensic reconstruction worked: Sysdig observed and reconstructed the chain in fine detail — specific fetched filenames, the MinIO default-credential probe, the cron beacon, the count of 1,342 encrypted configuration items, and the 31-second repair interval. That is a substantive telemetry capability, and it is why this case is evidenced at all.
- At least one Nacos validation path rejected the agent's first attempt: the brief records that the agent "repaired failed Nacos admin creation", so the initial backdoor-administrator creation did not succeed on the first try.
- A vendor patch for the entry vulnerability exists: CVE-2025-3248 is a deterministic, patchable defect in Langflow, and the remediation path is inventory plus staged redeployment rather than an unfixable model property.
- The MySQL root credentials were not obtained from the Langflow host in the observed telemetry — Sysdig records that their origin "was not observed", so the Langflow secret sweep is not evidenced as the source of the database credential.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.06–0.81 (midpoint 0.44), Tier 1 MVT 0.60 indeterminate | |||
| Ro-4Poisoning Attack Resistance | 0.25w 0.25 | 0.25 — a released software build implies basic format and packaging validation, but there is no evidence of adversarial screening, digest reconciliation or provenance checking on the AI workflow supply chain, and no evidenced integrity baseline for the flow and configuration stores. Scored on the software/artefact integrity leg of Ro-4, not on training-data poisoning, which this case does not evidence. | The deployment ran a Langflow build still vulnerable to the publicly known CVE-2025-3248, and the brief's remediation-lifecycle control (AID-H-003.010, High) frames the work as reconciling every deployed instance against the CVE and proving no vulnerable digest remains — i.e. that reconciliation had not been done. AID-R-002 (Very High) notes that "trusted pre-incident backups, restore drills, schema validation, and integrity checks are direct recovery controls" for the encrypted configuration rows and dropped tables, offered as controls to establish rather than controls observed.source: brief |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 1 MVT 0.60 indeterminate | |||
| Transparency (Tr) — scenario interval 0.17–0.72 (midpoint 0.45), Tier 1 MVT 0.55 indeterminate | |||
| Tr-3Audit Trail Completeness | 0.50w 0.25 | 0.50 — the trail reconstructs the session well but has gaps for the tool-mediated and credentialed workflow: actor-identity/credential provenance is missing for the pivot step, which is exactly the 0.50 criterion. It does not reach 0.75, which requires required fields captured for most workflows within a defined retention and review process on the victim's side. | Sysdig reconstructed the session in detail — payload behaviour, enumerated context, specific fetched files, the MinIO probe, cron beacon installation, Nacos admin creation and its 31-second repair, README_RANSOM and the destructive DDL. Against that, the record could not establish the provenance of the MySQL root credentials ("credentials whose origin was not observed"), and the brief's detection guidance lists Langflow exploit paths, Base64 Python execution, secret sweeps, cron beacons and destructive DDL as detections to add.source: researcher |
| Tr-4Model Lineage Disclosure | 0.25w 0.20 | 0.25 — the base component (Langflow, at a CVE-identifiable version) is determinable, but deployment-level lineage is incomplete: no reconciled asset inventory, no ownership or exposure-intent record, no manifest of mounted secrets or reachable services, and no established origin for the credential used in the pivot. | AID-M-001.005 (Very High) exists in this case precisely because the exposed AI endpoint had not been "reconciled to an owner, exposure intent, and authentication requirement". The first defender action is to "inventory Langflow and similar AI workflow servers, including version, exposure, authentication mode, runtime user, mounted secrets, outbound network policy, and reachable internal services".source: brief |
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 1 MVT 0.60 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.58 (midpoint 0.29), Tier 1 MVT 0.65 confirmed breach | |||
| Cn-1Scope Enforcement | 0.00w 0.12 | 0.00 verbatim — "No effective scope boundaries. System can access unauthorized data, tools, networks, or resources." Filesystem, secret, egress and internal-network scope were all unbounded from the AI workflow runtime. | The compromised Langflow process could read the host filesystem and environment (credentials.json, .env), dump Langflow backing data, install a cron beacon, egress freely for callback and staging, and reach MinIO, Nacos and MySQL directly. AID-I-002.001 is rated Very High on exactly this ground: "If a compromised Langflow host cannot reach Nacos, MySQL, MinIO, secret stores, or service-discovery endpoints except through explicit policy, RCE does not naturally become database extortion."source: brief |
| Cn-2Escalation Prevention | 0.00w 0.16 | 0.00 verbatim — "No escalation controls. Users or agents can obtain higher privileges, invoke restricted tools, or bypass approval workflows." An anonymous caller obtained code execution and then administrative authority on a downstream control plane with no approval workflow anywhere on the path. | An unauthenticated code-validation endpoint executed attacker-supplied Base64 Python with full interpreter capability (CVE-2025-3248). The chain then reached MySQL as root and exploited Nacos auth-bypass and default-token paths to insert a backdoor administrator.source: brief |
| Cn-5Agent Identity Integrity | 0.00w 0.14 | 0.00 verbatim — "No identity verification. Agents, tools, or peers accept arbitrary identities or unauthenticated calls." Both the AI workflow surface and two downstream service identities accepted unauthenticated or default-credential callers. | The code-validation endpoint accepted unauthenticated calls; MinIO was probed successfully with default credentials; Nacos default-token paths were exploitable. AID-H-004.002 (High) states the missing control directly: "At the Langflow API or gateway, authenticate the calling workload, application, or external integration before delivering requests to code-validation and internal service paths."source: brief |
Unknown, not N/A: 17 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.85w 0.35 | Above the 0.75 anchor. The Langflow workflow runtime executed code and tool nodes with unrestricted interpreter capability and no per-action human approval — the code-validation surface executed submitted Python outright — and the runtime carried provider, object-store and database credentials it could exercise. It stops short of 1.00 because the assessed system is a workflow execution platform running human-authored flows, not a self-directed agent selecting its own consequential objectives; the goal-selecting autonomy in this case belonged to the attacker's payload, which is out of scope. elevated |
| AsAttack Surface Exposure | 1.00w 0.25 | Maximum exposure. The deployment was internet-facing with an unauthenticated dynamic-code-execution endpoint reachable by anonymous callers, discoverable by credential-free outside-in scanning (AID-M-001.005, Very High). This exceeds the 0.75 anchor's "partially trusted" external data sources: the accepted input was arbitrary executable code from wholly untrusted callers, with tool and connector integration behind it. elevated |
| CpCascade Potential | 1.00w 0.25 | No System Dependency Graph is published for the victim estate, so the spec's DGC gate defaults Cp to 1.00 — but this case also triggers the 1.00 anchor independently on the observed trace, which is why the basis is corroborated rather than default. Traced path: an entry-exposed L3 code-validation endpoint (unauthenticated origin) → arbitrary execution in the L2/L3 workflow runtime → harvest of credentials.json, .env, MinIO keys and provider keys (credential-tier material) → L4 downstream systems MinIO, Nacos and MySQL → insertion of a backdoor Nacos administrator, which is a P4 credential- and permission-issuing terminal → encryption of 1,342 configuration items and dropping of tables and whole schemas, which are delegated-irreversible action nodes. The path was ungated end to end (no gate can be claimed at CBR ≥ 0.95 anywhere on it), reaching both a P4 node and delegated-irreversible actions, and PAD ≥ 3 from an unauthenticated origin.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.25w 0.15 | Model-adjacent, days to implement. CVE-2025-3248 has a vendor patch, and the remaining remediation set is entirely infrastructure and permission work: restricted interpreters or disabling dynamic-code features, authenticated exposure at the gateway, network segmentation from Nacos/MySQL/MinIO/secret stores, default-deny egress, credential rotation and removal of attacker-created accounts. Nothing on the remediation path requires model change or is a fundamental model property; the recovery burden (restore and integrity checks) is operational rather than intractable. |
Nelevated = 3 (dimensions strictly above 0.75) → CRM = 1.35.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.20 | Below the 0.25 anchor. The software component is identifiable (Langflow at a CVE-2025-3248-affected version) but almost nothing else about the assessed deployment is documented: no owner, no model or provider inventory, no manifest of mounted secrets, no record of authorised network reach, and — an explicit, named provenance gap — the origin of the MySQL root credentials the agent used was never established. The brief's first remediation action is to build the inventory that provenance would have supplied. |
| Ec — Public evaluation coverage | 0.26 | coverage 0.26 (6 of 23 applicable sub-metrics) × independence 1.00 × fidelity 1.00. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.14 | Evidence dated 2026-07-01; age 43 days on the workpaper reference date. Components: T_containment 0.14 · C_event 0.35 · T_calendar 0.37 · C_monitor 0.65 · C_evidence 0.85. Binding term: T_containment. dt_days = 43, measured from Sysdig's publication on 2026-07-01 (the AIDEFEND brief republished the analysis on 2026-07-06) to the assessment date 2026-08-13. agentic = true: Agentic/MCP class with a runtime that can be reprovisioned with new tools and credentials, so the containment staleness floor (M_Cn = 2.0) applies. baw = false — and this is a deliberate scoping call: the mutable behavioural state in this case belonged to the attacker's LLM-assisted agent, not to the victim system. The public evidence does not establish cross-session model-writable memory, a live agent-to-agent channel, self-modifying prompts, or a closed feedback loop inside the assessed Langflow deployment, so no item of the BAW applicability checklist is met and no C_behavior cap is applied. C_monitor = 0.65 — detection failure: the chain ran from RCE through secret sweep, pivot, backdoor administrator and destructive DDL to completion, the detections the brief prescribes were absent on the victim side, and the credential provenance gap is itself a telemetry gap. C_event = 0.35 — major event: confirmed active compromise with credential theft, an attacker-created administrator, and destruction of configuration and schemas. C_evidence = 0.85 — unresolved: whether the exposed credentials were rotated, the attacker-created accounts removed, and the restore and integrity checks completed is not established in the public record. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.19 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-002.001 | Internal AI Network SegmentationParent AID-I-002 (Network Segmentation & Isolation for AI Systems), catalogue dataVersion 2026.08.05. The parent maps to Cn-4, but in this case the evidence the control speaks to is scope reach, which is scored under Cn-1; Cn-4 is not scored because no timing, cache, telemetry or accelerator leakage channel is reported. | Very High | Cn-4 |
| AID-R-002 | Data Integrity Recovery for AI SystemsdataVersion 2026.08.05. Direct evidence for the Ro-4 score — the absence of an evidenced trusted-backup and integrity baseline for the encrypted configuration rows, dropped tables and dropped schemas. | Very High | Ro-4 |
| AID-H-025.002 | Safe Interpreter EnforcementParent AID-H-025 (Unsafe Code Execution Prevention), dataVersion 2026.08.05. Cn-3 is not scored for this case: the failure is an unrestricted execution surface, not an unsafe-output filtering failure, and forcing the Cn-3 output rubric onto it would misreport what was measured. The control's evidence is carried by Cn-1 (scope) and Cn-2 (escalation) instead. | Very High | Cn-3 |
| AID-M-001.005 | Public AI Endpoint & Agent-Service Exposure DiscoveryParent AID-M-001 (AI Asset Inventory & Mapping), dataVersion 2026.08.05. Basis for the Tr-4 lineage score and corroborating for Cn-5 (unauthenticated exposure). The Fa-3 leg of the parent mapping is not exercised — this case carries no fairness evidence. | Very High | Cn-5 Fa-3 Tr-4 |
| AID-H-004.002 | Service & API AuthenticationParent AID-H-004 (Identity, Access & Trusted Communication for AI Systems), dataVersion 2026.08.05. Direct evidence for the Cn-5 = 0.00 score (unauthenticated workload calls accepted at the code-validation path) and corroborating for the Tr-3 actor-identity gap. | High | Cn-5 Tr-3 |
| AID-I-001.004 | Sandbox Network Egress RestrictionsParent AID-I-001 (AI Execution Sandboxing & Runtime Isolation), dataVersion 2026.08.05. Pr-2 is not scored: the evidence concerns callback traffic, cron beacons and opportunistic service probing (egress scope, captured under Cn-1), not membership-inference or model-inversion resistance. | High | Cn-7 Pr-2 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleParent AID-H-003 (Secure ML Supply Chain Management), dataVersion 2026.08.05. Both legs are exercised here: the unreconciled CVE-2025-3248 digest population is the Ro-4 supply-chain evidence and the missing version/exposure inventory is part of the Tr-4 evidence. | High | Ro-4 Tr-4 |
| AID-E-001.001 | Root & Long-Lived Credential Object EvictionParent AID-E-001 (Compromised Credential, Session, Principal & Grant Eviction), dataVersion 2026.08.05. Corroborates Cn-5 and is the basis for the C_evidence = 0.85 cap: the eviction and rotation work (database root, Nacos administrator, provider, cloud and MinIO keys, attacker-created objects) is not established as complete. | High | Cn-5 |
| AID-E-004 | Incident Exploit-Path Closure VerificationAID-E-004 is absent from the reconciled AIDEFEND-to-AITBM lookup (dataVersion 2026.08.05); no sub-metric mapping is asserted. Recorded because it is one of the nine defences the brief lists. | High | ACI:C_event recovery ACI:containment/behavioral re-attestation |
WHAT THIS CASE TEACHES
JADEPUFFER is the case that forces the assessor to keep the attacker out of the assessed system: the agentic behaviour that compressed the kill chain to 31-second self-repair belonged to the offence, so it drives no ORP or BAW score here — what AITBM scores is a Tier 1 workflow host with Cn-1, Cn-2 and Cn-5 all at 0.00 and a corroborated Cp = 1.00 traced from an unauthenticated origin to a P4 backdoor-administrator terminal.
Sources: AIDEFEND in Action brief — JADEPUFFER Shows Agentic Ransomware Moving From AI RCE to Database Extortion (2026-07-06) · Sysdig — JADEPUFFER: Agentic Ransomware for Automated Database Extortion (Michael Clark, 2026-07-01)