Sysdig’s Threat Research Team, led by Senior Director Michael Clark, published its analysis on July 1, 2026. The team’s telemetry showed a coherent, self-directed operation running against an internet-facing Langflow instance in late June, then pivoting to a production database server and destroying its contents. The operator has no public identity, no leak site, and no overlap with known crews — Sysdig had to name it themselves.

The naming decision matters. Sysdig coined “agentic threat actor” (ATA) as a new category, distinct from human operators using AI-assisted tools. The distinction is that JadePuffer’s payloads showed hallmarks that only an autonomous language model would produce by default: extensive natural-language comments explaining reasoning, target prioritization written into the code itself, and recovery behavior that treated errors as prompts to reason about rather than exceptions to catch.

Across the operation, Sysdig captured more than 600 distinct payloads, each purposeful, each fitting into a broader plan. That volume in a compressed window is difficult to reconcile with a human operator hand-writing exploits. It’s easy to reconcile with an LLM iterating on a task list.

Langflow is a popular open-source framework for building LLM apps and agent workflows. CVE-2025-3248 is a missing-authentication vulnerability in its /api/v1/validate/code endpoint. Anyone who could reach a vulnerable Langflow server over the network could send Python code to that endpoint and have it executed on the host, no login required. Rated critical, publicly patched in Langflow 1.3.0, and added to CISA’s Known Exploited Vulnerabilities catalog in May 2025.

JadePuffer sent its payloads as Base64-encoded Python through that endpoint. Once inside, the agent enumerated the host, listed environment variables, dumped Langflow’s Postgres database, and searched for API keys and cloud credentials in files with names like .env and credentials.json. It also probed an S3-compatible MinIO object store that was still using default credentials, and began targeting files whose names suggested secrets.

For persistence, the agent installed a cron job on the Langflow host configured to beacon to command-and-control at 45.131.66[.]106:4444 every 30 minutes. Sysdig published this and other indicators publicly so defenders can hunt for the same behavior in their own environments.

From the Langflow host, the agent identified a separate production server exposing MySQL and Alibaba Nacos, a service-discovery and configuration platform. It attacked with multiple vectors at once. The clearest was CVE-2021-29441, a four-year-old Nacos auth bypass that lets an attacker skip authentication by spoofing the User-Agent header, combined with forged JWTs signed using Nacos’s publicly documented default signing key.

Then came the moment that convinced Sysdig this was not a script. The agent tried to create a new Nacos administrator account using a generated bcrypt hash. The hash format was wrong. The login failed. A rigid tool would have stopped or repeated the same broken request. Instead, the agent diagnosed the hash generation error, deleted the broken account, regenerated the hash correctly, rebuilt the administrator, and verified the login. Total elapsed time: 31 seconds.

Sysdig’s report calls out this sequence explicitly. Machine-speed self-correction across multiple distinct fixes, rather than blind retries with the same parameters, is the behavior signature of a reasoning agent — not a scanner, not a hand-written script, and not a human operator who would typically take minutes to hours to debug the same issue.

After taking over Nacos, the agent used MySQL’s AES_ENCRYPT() function to encrypt all 1,342 Nacos configuration items stored in the backing database. It then dropped the original config_info and history tables, deleting the source of truth. In their place, the agent created a table named README_RANSOM containing a ransom demand, a Bitcoin wallet address, and a Proton Mail contact address for negotiations.

The encryption key was the problem. Sysdig observed that the AES key was generated by concatenating random UUIDs, printed once to standard output, and never persisted or transmitted. There is no key on any server, no key in the C2 traffic, no key the operator could hand over even if they wanted to. Paying the ransom would recover nothing. The Bitcoin address in the note is itself an anomaly — it matches the example address from Bitcoin’s developer documentation, widely present in LLM training corpora, though blockchain records show it as an active wallet with roughly 46 BTC of historical activity.

The final phase escalated further. The agent moved from row-level encryption to dropping entire database schemas, self-narrating its rationale for target selection in the code comments. A comment in the code claimed the deleted files had been backed up to an external IP address for extortion leverage, but Sysdig found no evidence in the network traffic that any exfiltration actually occurred. The agent may have been bluffing on its own initiative.

Sysdig frames JadePuffer as a warning sign, not a crisis. None of the exploited weaknesses were novel. Langflow’s CVE was already patched. Nacos’s auth bypass was four years old. Default credentials in the S3-compatible object store were textbook exposures. The pattern that changed is who was doing the chaining. An AI agent with no fatigue, no wage, and no domain expertise can now enumerate the long tail of forgotten systems, test known weaknesses in parallel, adjust after failures, and destroy production data before defenders finish triage.

Shane Barney, CISO at Keeper Security, told SC Media that 72% of organizations cannot detect credential misuse in real time, with most identifying unauthorized privileged access within hours rather than minutes. An agent operating at machine speed moves through that gap before humans arrive. Heath Renfrow, CISO at breach recovery firm Fenix24, put it more bluntly: agentic threat actors compress attacks that once took hours into minutes, which erodes response windows across every incident-response phase.

Sysdig’s practical recommendations are unsentimental. Patch CVE-2025-3248 and never expose Langflow’s code-execution endpoints to the internet. Change Nacos’s default signing key and never let Nacos reach its backing database as root. Don’t run AI orchestration servers with provider API keys in their environment variables. And build runtime detection that flags LLM-generated code patterns — those annotated payloads are, ironically, a detection opportunity.