What happened

Initial access came through CVE-2025-3248, a missing-authentication flaw in Langflow — a popular open-source framework for building LLM apps — that lets an unauthenticated attacker run arbitrary Python on the host. Langflow servers are attractive precisely because they're AI-adjacent: they often hold provider API keys and cloud credentials and get stood up fast without network controls. All payloads arrived as Base64-encoded Python through the vulnerable endpoint.

From there Sysdig watched a full playbook unfold across two hosts. On the Langflow box: host enumeration, then a parallel sweep for secrets — LLM provider keys (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials with explicit coverage of Chinese providers (Alibaba, Aliyun, Tencent, Huawei) alongside AWS/GCP/Azure, crypto wallets, and database configs. It dumped Langflow's own Postgres, scanned the internal network, found a MinIO object store on default credentials (minioadmin:minioadmin), and pulled a credentials.json and .env from an internal bucket. It installed a cron job beaconing to attacker infrastructure every 30 minutes.

The real target was a separate internet-exposed server running MySQL and an Alibaba Nacos configuration service. The agent attacked Nacos through multiple vectors at once — a 2021 auth-bypass (CVE-2021-29441), a forged JWT using Nacos's publicly documented default signing key, and a backdoor admin injected straight into the database. Then it encrypted all 1,342 Nacos config items with MySQL's AES_ENCRYPT(), dropped the original tables, and wrote a README_RANSOM table demanding Bitcoin. Crucially, the encryption key was random, printed to stdout once, and never saved or transmitted — so the victim can't recover the data even if they pay.

Why it matters

Sysdig lays out four lines of evidence for autonomy. The payloads are self-narrating — saturated with natural-language commentary explaining ROI target prioritization and why each step is taken, the way LLM-generated code does by default and disposable human one-liners do not. The operation diagnosed and fixed its own failures at machine speed: after a Nacos backdoor login failed at 19:34:36, a 15-line corrective payload that deleted the account, confirmed a library import, and rebuilt it with a working hash landed by 19:35:07 — 31 seconds, with the login succeeding at 19:35:18. When a DROP DATABASE failed on a foreign-key constraint, the next payload wrapped it in SET GLOBAL FOREIGN_KEY_CHECKS=0 — a fix that requires understanding why it failed. Across the incident Sysdig counted more than 600 distinct, purposeful payloads.

The implication is economic. Ransomware tradecraft that once implied a skilled human now implies a capable model. Agents make spraying the entire historical vulnerability catalogue effectively free, so the long tail of neglected, internet-facing systems becomes more exposed, not less — and if the agent runs on stolen API credits via "LLMjacking," the attacker's cost approaches zero. A defense process that waits for a human to work an alert queue may simply be too slow against an attacker diagnosing and correcting itself in seconds.

The fine print

Sysdig's evidence does not independently prove no human was involved, and it could not inspect the agent's system prompt or configuration. The ransom note claims AES-256, though MySQL's AES_ENCRYPT() defaults to AES-128-ECB. Its Bitcoin address is both the canonical example from developer documentation, and therefore common in LLM training data, and a live wallet with 737 transactions: it may be a hallucinated address swept by a third party or a deliberately configured wallet. Sysdig cannot tell which. The "data already backed up" line was the agent's assertion, not verified exfiltration.

The suspected AI agent helped reveal itself by writing unusually readable, well-commented attack code. Decades of engineering managers asking for better documentation, and the lesson may finally have landed — on ransomware.