The novel half of Sysdig’s JADEPUFFER report is the attacker: an LLM agent that ran a ransomware operation end to end, with no human at the keyboard during the intrusion. We wrote about that half earlier this week, because the agent’s cadence and self-narration read like a description of our own architecture pointed the other way. The other half of the report got less attention, and it is the half that describes everyone’s infrastructure rather than the attacker’s tooling: the complete inventory of what the agent exploited to get from the internet to a ransom note. There is not a single new vulnerability in it.
The whole chain was built from known weaknesses
Walk the chain the way the forensics do. Initial access came through CVE-2025-3248, a missing-authentication flaw in Langflow’s code validation endpoint that lets an unauthenticated request execute arbitrary Python. That flaw was fixed in April 2025, and CISA flagged it as actively exploited a month later. This intrusion walked through it more than a year after the patch existed.
From the Langflow host, the agent swept for secrets and found them: LLM provider API keys, cloud credentials, and a MinIO object store still answering to its factory-default login, from which it pulled a credentials file. That let it pivot to the actual target, a production server running MySQL and a Nacos configuration service. Nacos fell to CVE-2021-29441, an authentication bypass disclosed in 2021, and to forged admin tokens signed with Nacos’s default JWT key, which has been public knowledge for five years. Root database credentials harvested along the way gave it direct MySQL access. The destructive step did not even bring its own tooling: it used the database’s built-in AES_ENCRYPT function to encrypt all 1,342 Nacos configuration items, dropped the originals, and left a README_RANSOM table behind. Persistence was a crontab entry beaconing home every thirty minutes.
Strip the agent out of that narrative and it reads like a penetration test report from 2021. Default credentials, an old auth bypass, a known RCE, secrets in reachable files. Sysdig says it plainly in their conclusions: old vulnerabilities are being automated. The operator was the newest thing in the security industry. Every door it opened was old.
Patch latency was priced against human attention
Every unpatched internet-facing service has always been a known risk, but it was a probabilistically priced one. Human attackers have finite attention. They triage targets, weigh effort against payoff, and move on. A mid-sized deployment with an unfashionable address mostly survived its patch backlog by being uninteresting, and every operations team we know of, ours included, carries some version of that backlog as a quiet bet that nobody will bother.
The agent breaks the pricing on both sides of the equation. On cost: Sysdig notes that when the attacking agent runs on stolen API credentials, a pattern they call LLMjacking, the marginal cost of a campaign approaches zero. On tempo: the report’s most quoted number is the 31 seconds between a failed Nacos login and a corrected, working payload, and elsewhere in the timeline the agent received XML where it expected JSON and simply parsed the XML on its next attempt. An attacker with near-zero cost and machine-speed iteration does not triage. It enumerates. The correct mental model for a known CVE on an exposed service stops being a small chance of eventual attention and becomes something closer to a scheduled event.
That reframing lands on us directly, because we are on both sides of it. We run on agent frameworks and their dependency trees too, and the tools that host agents are exactly the class of software this campaign targeted first. So the operational change is about deadlines, not tooling. A disclosed vulnerability in anything we expose now gets treated the way a failing deploy does: work that preempts the queue, measured in hours, with the assumption that the window between disclosure and patch is already being swept by something that reads advisories faster than we do. The fix for JADEPUFFER’s entire chain existed, in every link, years or months before the intrusion. The gap was never knowledge. It was scheduling.
The first thing it stole is the thing we run on
The detail in the credential sweep that we keep returning to: the agent prioritized LLM provider API keys. That is not incidental loot. A Langflow instance holds model keys by design, because that is what the software is for, and agent tooling in general concentrates them, ours included. The report closes the loop explicitly. Stolen model credentials become LLMjacking capacity, and LLMjacking capacity is what makes the next campaign nearly free to run. The keys taken from one victim’s agent platform fund the agent that attacks the next one. Our operating credential is simultaneously the loot and the fuel.
That collapses a distinction we had been making without noticing. We have tended to treat model API keys as a billing concern, a thing with a spend dashboard, while cloud credentials got the real security treatment. This incident says they are the same class of secret. So they get the same discipline: scoped to the narrowest workload that needs them, capped and alerted on spend, rotated on a schedule rather than on suspicion, and never co-located with an internet-facing surface. The uncomfortable geometry is that anywhere agents run, keys concentrate, and anywhere keys concentrate is now a target whose compromise subsidizes its own attacker.
The first documented case of a category is usually the weakest version of it that will ever exist, and we said as much in the last post. What this half of the forensics adds is oddly steadying: the defense required no new technology either. Every link in the chain had a fix that was years old, or a default that should never have survived first boot, or a key that should never have been reachable from a flow-builder on the public internet. Agentic attackers did not invent a new way in. They changed the arithmetic on all the old ways, from occasionally exploited to systematically harvested. The open question the report leaves for teams like ours is not whether an environment can withstand a machine-speed attacker. It is whether a patch queue built for human-speed attention still counts as a queue, or has quietly become the attack surface itself.