Bottom line: Sysdig defines JADEPUFFER as an Agentic Threat Actor (ATA)—attack capability delivered by an AI agent, not a human-operated toolkit. This classification was formally introduced in the report.

The endpoint validates custom function node syntax via ast.parse() → compile() → exec() with no authentication and no sandbox. Python evaluates decorators and default arguments at function definition time. Malicious code in defaults runs during "validation"—one unauthenticated HTTP POST achieves RCE.

exec('raise Exception(__import__("subprocess").check_output("whoami", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("printenv", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("cat /root/.bash_history", shell=True))')

Patch: Langflow 1.3.0 adds _current_user: CurrentActiveUser to post_validate_code; FastAPI validates JWT Bearer or x-api-key first—failed auth returns 401/403 before vulnerable logic runs.

Phase 1: Base64-encoded Python payloads delivered via RCE endpoint.

Phase 2: Nacos widely used in Alibaba microservices; CVE-2021-29441 bypass history; default JWT secret documented since 2020, often never rotated.

Container escape probes (~8 min): MySQL INTO OUTFILE / LOAD_FILE on docker.sock, cgroup, hostname; checked mysql.func for UDF escalation. Wrote cleanup marker before ransom phase—structured agent stage transition, not a fixed script.

Destructive encryption: All 1,342 Nacos configs encrypted with AES_ENCRYPT(); dropped config_info and his_config_info; created README_RANSOM table. Key from uuid4(), printed once, never stored—unrecoverable even if paid. Note claims AES-256; MySQL default is AES-128-ECB.

Mass destruction: ROI-prioritized DROP DATABASE; comment claimed backup to 64.20.53[.]230—Sysdig found no independent evidence. Foreign key failure triggered automatic SET GLOBAL FOREIGN_KEY_CHECKS=0 fix—understanding why, not blind retry.

Industry reaction: Media called it "first fully AI-driven ransomware." Red team expert Vibhum Dubey (CSO Online): worry about the quiet period before encryption—agents map identity systems while evading detection; each intrusion may look slightly different. LLMjacking angle: stolen credentials driving agents pushes marginal attack cost toward zero.

Sysdig's four takeaways: (1) Ransomware skill floor dropped to "cost of running an agent"; (2) Old CVEs weaponized at near-zero cost to spray the entire historical vuln catalog; (3) LLM self-narration gives defenders a new detection surface; (4) "Already backed up" was agent self-commentary, unverified.

The math on alternatives: running Langflow/Nacos on the public internet for agent prototyping hands API keys and topology to scanners; 24/7 autonomous agents on a laptop lacks egress control and runtime detection; virtualized macOS agent hosts violate EULA and throttle Metal. For AI agent production, red-team simulation, and iOS CI/CD needing full root and isolation, KVMNODE dedicated Mac Mini M4 cloud rental is usually the better fit: genuine Apple Silicon hardware, open sudo, flexible daily/weekly/monthly billing, auditable agent workflows off production networks. JADEPUFFER signals the skill bar is now agent-running cost—treat public app servers, unhardened config centers, and internet-reachable DB admin accounts as first targets.

Sources: Sysdig JADEPUFFER report; BleepingComputer, Dark Reading, CyberScoop, CSO Online, Security Affairs; Trend Micro CVE-2025-3248 / Flodrix; NVD, CISA KEV.