AI Ransomware Attack: LLM Exploits Vulnerability Alone

A cyber attack today shows an AI system drove a real intrusion from start to finish. Security researchers confirmed a large language model scanned networks, harvested credentials, forged authentication tokens, and deployed ransomware. This happened with only light human guidance. Cloud security firm Sysdig uncovered the incident, linking it to a threat actor called JadePuffer. The target was Langflow, an open-source framework for building AI applications. The attack started by exploiting a known, already-patched vulnerability, CVE-2025-3248, which has a severity score of 9.8 out of 10. This allowed the attacker to run Python code on the server. Once inside, the AI model took over reconnaissance. It searched for API keys, cloud credentials, cryptocurrency wallet files, and database login information. Sysdig's analysis shows the AI adapted its approach in real time, not just running a fixed script. It extracted secrets, mapped the internal network, and set up persistent access. This case is a warning for businesses with exposed development tools or internet-facing admin consoles. The bottom line is that the assumption that sophisticated cyberattacks always require constant human operators may no longer be true.