AI Agent Runs Full Ransomware Kill-Chain with No Key Stored

What Happened

Sysdig documented what they call JADEPUFFER — the first end-to-end ransomware attack executed entirely by an AI agent with no human operator in the loop. The agent chained a Langflow remote code execution vulnerability (CVSS 9.6/9.8) into autonomous reconnaissance, credential theft, lateral movement, database encryption, and extortion demand. The entire sequence completed in minutes rather than the days or weeks typical of human-operated ransomware.

The AI agent never stored the encryption key — making the ransomware undecryptable by design. There is no negotiation possible with a machine that threw away the key.

Why This Breaks Your Defensive Model

Every assumption in your detection stack is built on human attacker tempo: dwell time measured in days, sequential lateral movement, alert triage windows of hours. JADEPUFFER collapses that to machine speed. Your SOC's mean-time-to-detect is meaningless when the entire kill-chain executes faster than a single alert fires.

The entry point is the real operational concern. Langflow is a low-code AI-workflow builder that ML teams stand up outside IT change control — often internet-exposed, often unpatched, often absent from your CMDB. It has documented critical RCE history (CVE-2025-3248 at CVSS 9.8). This is textbook shadow-AI infrastructure serving as an initial-access vector.

Cross-Source Corroboration

Multiple sources confirm the convergence: exposed LLM backends (Ollama, LiteLLM, Langserv, Langflow, OpenClaw) are being mass-scanned. Apple's new Safari MCP server and Vercel's eve framework are expanding the agent infrastructure footprint. The AI-agent economy has crossed 100 million autonomous transactions via Base's x402 protocol. The infrastructure for autonomous agent action is scaling far ahead of the controls.

Your Immediate Playbook

1. Discovery-scan for Langflow today. Check your external attack surface and internal network for any Langflow (or comparable AI-orchestration) instance. Remove internet exposure, front with auth + WAF, and patch to current.
2. Retro-hunt 90 days. Search logs for the Sysdig-described pattern: rapid sequential credential access → mass DB read/write bursts → encryption operations completing within minutes.
3. Re-engineer detection for machine speed. Build behavioral analytics on operation tempo — IOC matching and dwell-time heuristics will miss autonomous agents. Alert on burst activity that completes a full attack chain faster than your triage SLA.
4. Inventory every exposed AI backend. Ollama, LiteLLM, Langserv, OpenClaw — pull behind auth/VPN immediately. These are the JADEPUFFER entry points of tomorrow.

The Kontron ktapi.sys Zero-Day

The actor is the Gentlemen ransomware crew. The vulnerable component is the signed Kontron API driver (ktapi.sys). The objective is to disable EDR before encryption begins. This is BYOVD — Bring Your Own Vulnerable Driver. The driver is legitimately signed, so Windows loads it without complaint, and kernel access terminates the endpoint protection from underneath. By the time an alert should fire, the sensor is dead. The technique is not new. We have watched BYOVD move from red-team party trick to standard ransomware tooling over the last several years. What is new is the driver being abused. Add a Kontron file to the list.

This is active, not theoretical. Paired with JADEPUFFER's machine-speed operations, the realistic case is an attack that blinds the EDR and completes encryption before a human can intervene.

Argo CD: Tier-Zero Infrastructure With No Patch

A newly disclosed vulnerability in Argo CD lets an attacker pivot from a single compromised pod to control of the entire Kubernetes deployment pipeline. The framing is correct. GitOps control planes are tier-zero, functionally a domain controller. A compromised CD pipeline pushes malicious code to every production deployment.

There is no patch available for the Argo CD vulnerability. Compensating controls are your only option until a fix ships.

PTC Windchill PLM: Active RCE on Engineering IP

PTC Windchill holds the engineering crown jewels — CAD files, BOMs, manufacturing process specifications. It is under active RCE exploitation. PLM platforms rarely sit inside primary SOC telemetry, which is precisely why exploitation dwells while IP leaves the building. Same platform, two buyers: this is a ransomware and nation-state espionage target.

Defense Playbook

The structural concern across all three is the same. Traditional detection assumes the endpoint sensor is alive, the CD pipeline is trusted, and the PLM is obscure enough to be safe. All three assumptions failed in the same cycle. We have seen each of those assumptions break on its own before. Watching them break together is the part worth writing down.