JadePuffer shows how agentic ransomware still depends on human control

At a glance

What this is: Expel says JadePuffer is being framed as a fully agentic ransomware campaign, but the operator still directed the LLM and the attack depended on basic exploit and extortion mistakes.

Why it matters: This matters because security teams now need to separate agent behaviour from human accountability while hardening the same fundamentals that still stop ransomware, including exploit exposure, recovery readiness, and command oversight.

By the numbers:

• The article says the campaign exploited CVE-2025-3248 and then retried failed steps to improve success.

Context

Agentic ransomware is malware or intrusion activity in which an AI system can choose and retry actions during execution rather than following a fixed script. The governance problem is not that the system is autonomous in the strict sense, but that human operators can delegate enough control to accelerate an attack while obscuring who made the operational decisions.

This case sits at the intersection of ransomware, exploit-driven intrusion, and agentic AI governance. For IAM and NHI practitioners, the useful question is not whether an AI was present, but whether the attack path depended on exposed credentials, unmanaged tools, or weak recovery assumptions that still map to conventional control gaps.

Expel’s framing is especially relevant because it separates the agent from the operator. That distinction is typical of where the field is headed: more adaptive attack tooling, but still a human threat actor accountable for scope, intent, and execution.

Key questions

Q: What fails when ransomware operators add an LLM to their attack workflow?

A: The failure is usually not the model itself but the speed and adaptability it adds to an already valid intrusion path. If defenders rely on manual response, static signatures, or slow containment, an agent can retry actions and make a marginal exploit far more reliable. The right focus is still exploit exposure, access control, and recovery resilience.

Q: Why do agentic ransomware campaigns still depend on human accountability?

A: Because the human operator chooses the target, initiates the workflow, and decides how far the attack should go. The AI can execute steps, but it does not remove intent, ownership, or legal responsibility. Security teams should preserve traces that show who directed the agent and what privileges were used.

Q: What are the signs that agentic attack tooling is amplifying a ransomware intrusion?

A: Look for short-interval retries, repeated task failures followed by immediate alternate attempts, and a faster transition from initial access to encryption activity than your environment usually sees. Those patterns suggest adaptive execution. They also mean containment windows are shrinking, so telemetry and response thresholds need to be tighter than for a conventional human-led attack.

Q: How should security teams compare agentic ransomware with traditional ransomware operations?

A: Traditional ransomware is often a scripted or manually driven intrusion chain, while agentic ransomware can modify its own execution sequence during the attack. The distinction matters operationally, but both still depend on access, privilege, and a successful extortion path. Defenders should not treat agentic behaviour as a new category of control failure.

Technical breakdown

How an agentic ransomware chain uses exploit access as the entry point

The reported JadePuffer chain starts with exploitation of CVE-2025-3248, which creates initial access without requiring a conventional login path. Once the first foothold exists, the agent can sequence follow-on actions, test failures, and repeat them with little manual supervision. That changes the defender’s problem from a single-shot intrusion to a machine-assisted campaign that can adapt mid-run. The important point is that the agent still needs an entry condition, and that entry condition remains a normal security weakness, not an AI-specific one.

Practical implication: prioritise the underlying exploit path and exposure window, not the novelty of the automation.

Why retry loops matter in agent-driven intrusion execution

An agent that can retry failed steps behaves differently from a static script because it can learn from immediate failure and continue without operator intervention at every stage. That does not make it autonomous in the governance sense, but it does increase the chance that a partially working attack becomes a successful one. In practice, retry logic amplifies weak controls around detection, containment, and environment hardening because the attacker can test alternate paths faster than a human-only workflow.

Practical implication: assume the attacker can iterate faster than analysts can respond and tighten detection around repeated failed action sequences.

Why extortion outcomes still depend on operator discipline

Expel’s commentary shows that the human operator still matters because ransomware success is not only about encryption. The attacker also has to preserve decryption capability, maintain extortion leverage, and avoid operational mistakes such as failing to store keys or provide payment instructions. Those are not AI problems. They are evidence that the attack remains a human-directed criminal operation using AI as an execution layer, not a self-governing threat actor with its own business logic.

Practical implication: keep attribution and incident response focused on the human threat actor while treating the agent as an enabling mechanism.

Threat narrative

Attacker objective: The attacker’s objective was to encrypt systems and pressure the victim into paying for recovery while using agentic tooling to increase execution success.

1. Entry occurred through exploitation of CVE-2025-3248, which gave the operator and agent a foothold for the ransomware workflow.
2. The agent then executed the rest of the attack chain, retrying failed steps to improve the chance of a successful encryption event.
3. Impact depended on the operator’s ability to direct the campaign and preserve extortion value, including decryption planning and payment leverage.

Breaches seen in the wild

• LiteLLM MCP auth bypass 2026: An exploited LiteLLM MCP auth bypass and default sk-1234 master keys let attackers steal AI gateway master and provider API keys.
• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic ransomware is an execution model, not a replacement for criminal tradecraft: the critical change is that the attack can be iterated by software while the operator still directs the campaign. That means defenders should not over-index on whether the attack is 'fully autonomous'. They should ask which parts of the intrusion chain are now machine-accelerated and which remain human-controlled, because accountability and containment still sit with the threat actor.

The governing failure mode here is operator-assisted automation without operational discipline: if the attacker cannot preserve keys, extort cleanly, or maintain coherent control, the campaign becomes noisy rather than decisive. That is a useful lens for defenders because it shows the limits of AI-assisted ransomware. The control gap is not only technical exposure, but the absence of attacker-side process maturity, which makes early detection and disruption more effective.

JadePuffer reinforces the need to treat exploit exposure and recovery resilience as the real defence boundary: agentic behaviour changes how quickly an adversary can exploit a weakness, but it does not eliminate the weakness itself. Detection-response latency: the shorter the attacker’s iteration loop, the less time defenders have to recover before impact. Practitioners should therefore focus on reducing dwell time, hardening vulnerable entry points, and preserving clean recovery paths.

Identity and privilege governance still matter because ransomware succeeds through access, not language models: where the article intersects with NHI and IAM is in how access is obtained, used, and preserved. If exposed services, tokens, or elevated accounts exist, an agent can operationalise them faster than a human toolkit. The practical conclusion is to govern the access layer as if an adaptive operator will eventually find it.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Detection-response latency: agentic attacks compress the time between initial access and impact, so defenders need telemetry and containment that can absorb repeated failed actions without human delay. The important shift is not from human to machine threat actors, but from single-step intrusion to adaptive execution that can keep probing until it succeeds, which makes every minute of containment work count.

The identity angle is real but narrow: once an attacker gains a foothold, exposed credentials, elevated accounts, and unmanaged access paths become faster to abuse when the operator can delegate execution to an agent. That is why NHI governance, privileged access review, and recovery planning remain central even when the headline is about AI.

AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026. The signal for practitioners is clear: treat agentic tooling as an amplifier of existing access and secrets weakness, not as a substitute for them.

For practitioners

• Harden known exploit entry points Patch and isolate the software paths that would let an adversary reach a ransomware foothold, with special attention to externally exposed services and proof-of-concept exploits like CVE-2025-3248.
• Detect repeated failed attack steps Tune detection for rapid retry patterns, repeated command failures, and short-interval replays that suggest an agent is adapting instead of a human manually troubleshooting.
• Separate operator accountability from AI tooling Keep incident analysis focused on who controlled the campaign, what access they used, and which steps were human-directed versus machine-executed.
• Protect decryption and recovery workflows Verify that backup recovery, key custody, and restoration procedures are independent of compromised environments so ransomware operators cannot destroy both encryption and recovery paths.
• Treat exposed credentials as an acceleration factor Review whether service credentials, API keys, or elevated accounts could let an adaptive intruder expand the initial exploit into broader impact before containment can take hold.

Key takeaways

• JadePuffer shows that agentic ransomware can speed up execution, but it still depends on a human operator and ordinary exploit conditions.
• The reported campaign used CVE-2025-3248 and retry logic, which means repeated attack attempts can turn a partial foothold into successful encryption.
• The most effective controls remain exploit reduction, access governance, and recovery resilience, because AI does not remove the need for access or extortion discipline.

Key terms

• Agentic Ransomware: Agentic ransomware is malware or a ransomware operation directed by an autonomous system that can plan, adapt, and change attack steps at runtime. The key difference is behavioural flexibility, which shortens response windows and makes rigid playbooks less effective.
• Detection-Response Latency: The elapsed time between identifying a security issue and executing a bounded, auditable fix. In data security programmes, long latency means exposure persists after discovery, which undermines the value of detection and weakens compliance evidence.
• Standing Access: Standing access is persistent privilege that remains available without fresh approval or contextual checks. In NHI environments, standing access usually appears as long-lived tokens, reusable service accounts, or broad roles attached to automation. It is convenient operationally, but it expands risk when conditions change or secrets leak.
• Operator-Controlled AI Attack: A malicious campaign in which an AI system carries out parts of the execution, but a human threat actor still chooses targets, provides access, and directs the overall objective. The governance question is accountability, not whether the AI is acting alone.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners align access control with real-world attack behaviour across human and non-human identities.