← JADEPUFFER – First Fully Autonomous AI Ransomware Targeting Crypto Wallet Keysreviewed 2026-10-17 · 25 claims checked
Fact-check findings
What an automated fact-checker found when it re-read JADEPUFFER – First Fully Autonomous AI Ransomware Targeting Crypto Wallet Keys against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
4 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #3[disputed][awaiting moderator]in section: Underlying Vulnerability: CVE-2025-3248
“Langflow patched the vulnerability on April 1, 2025, in version 1.3.0.”
reviewerLangflow patched the vulnerability on April 1, 2025, in version 1.3.0.The official GitHub release tag for 1.3.0 is dated March 31; the page's April 1, 2025 date is off by one day. Likely conflated with the CVE's NVD publication date (April 7, 2025) or a rounding error.Proposed correction (not yet applied)Langflow patched the vulnerability on March 31, 2025, in version 1.3.0. - #4[disputed][awaiting moderator]in the timeline
“2025-04”
reviewerTimeline: Langflow releases version 1.3.0, patching CVE-2025-3248, dated 2025-04.Same underlying date error as the prose in sections[1]; the stored date field should read 2025-03, matching the actual GitHub release date.Proposed correction (not yet applied)2025-03 - #8[disputed][awaiting moderator]in section: Underlying Vulnerability: CVE-2025-3248
“the Sysdig report itself cited approximately 7,000 exposed Langflow servers as of publication date”
reviewerThe Sysdig report itself cited approximately 7,000 exposed Langflow servers as of publication date.Double error: (1) the 7,000 figure was not stated by Sysdig itself, only linked via an external VentureBeat article; (2) that figure describes exposure to unrelated, later CVEs, not the CVE-2025-3248 flaw this page is about.Proposed correction (not yet applied)a VentureBeat article linked from the Sysdig report cited approximately 7,000 exposed Langflow servers, a figure describing different, later-disclosed Langflow vulnerabilities (CVE-2026-5027 and CVE-2026-33017) rather than CVE-2025-3248 - #9[disputed][awaiting moderator]in the timeline
“Approximately 1,050 to 7,000 Langflow instances remain publicly reachable at this date.”
reviewerTimeline: Approximately 1,050 to 7,000 Langflow instances remain publicly reachable as of Sysdig's July 2026 publication.Same underlying error as the sections[1] finding, presented as a hard figure in the timeline without the VentureBeat/different-CVE caveat.Proposed correction (not yet applied)Approximately 1,050 Langflow instances (per Recorded Future's Insikt Group) remain publicly reachable at this date; a separately cited figure of approximately 7,000 exposed servers refers to different, later Langflow CVEs (CVE-2026-5027 and CVE-2026-33017), not CVE-2025-3248.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #17[unverifiable][awaiting moderator]in section: ENCFORGE: Follow-On AI Model Ransomware Variant
“On approximately July 3, 2026, two days after the initial Sysdig disclosure, the same operator returned with a new compiled ransomware payload named ENCFORGE”
reviewerThe same operator returned with ENCFORGE on approximately July 3, 2026, two days after the initial Sysdig disclosure.Sysdig's own two posts are internally inconsistent about whether July 1 or July 3, 2026 is the initial-publication date, making the operator's exact return date impossible to pin down from primary sourcing alone. - #18[unverifiable][awaiting moderator]in the timeline
“2026-07-03”
reviewerTimeline: ENCFORGE return dated 2026-07-03.Same underlying ambiguity as the sections[4] finding; stated here as a hard date with no hedge. - #19[unverifiable][awaiting moderator]in the timeline
“JADEPUFFER attack against a live production system takes place in late June 2026, exploiting CVE-2025-3248 in an internet-facing Langflow instance.”
reviewerThe JADEPUFFER attack against a live production system took place in late June 2026.The specific 'late June 2026' attack date is not supported by the cited primary source (Sysdig), which does not disclose an intrusion date; secondary aggregator coverage is split on whether a date was ever disclosed. Treat as unconfirmed precision rather than an established fact.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #14[partially supported][awaiting moderator]in section: Overview and Attribution
“The ransom contact email (e78393397@proton.me) had zero hits in threat intelligence databases at the time of publication, and the listed Bitcoin address (3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy) matches the canonical sample address embedded throughout Bitcoin developer documentation, raising the possibility that the LLM hallucinated the wallet address from training data.”
reviewerThe ransom contact email had zero hits in threat intelligence databases, and the listed Bitcoin address matches the canonical sample address from Bitcoin developer documentation.Both facts are confirmed, but the page omits a material detail Sysdig reports: the address is a live wallet with 737 transactions and ~46 BTC received, which cuts against pure hallucination. The page's Unresolved Questions section does present both possibilities more neutrally, so this is a framing gap rather than a factual error.
confirmed
17 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“describing the operation as 'the first documented case of agentic ransomware: a complete extortion operation driven end-to-end by a large language model (LLM) rather than a human operator at each step.”
reviewerSysdig describes JADEPUFFER as the first documented case of agentic ransomware, a complete extortion operation driven end-to-end by an LLM.Verbatim phrasing confirmed by direct fetch of Sysdig's original post; correctly framed as Sysdig's own assessment, not an independently verified fact. - #2[confirmed][no action needed]in section: Underlying Vulnerability: CVE-2025-3248
“It carries a CVSS 3.1 score of 9.8 (Critical).”
reviewerCVE-2025-3248 is a missing-authentication RCE in Langflow's /api/v1/validate/code endpoint with CVSS 3.1 score of 9.8.Matches NVD/CVE record and multiple independent security vendor write-ups. - #5[confirmed][no action needed]in section: Underlying Vulnerability: CVE-2025-3248
“CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities (KEV) catalog on May 5, 2025.”
reviewerCISA added CVE-2025-3248 to its KEV catalog on May 5, 2025.Matches CISA KEV record exactly. - #6[confirmed][no action needed]in section: Underlying Vulnerability: CVE-2025-3248
“Exploitation in the wild was observed by GreyNoise from 361 malicious IP addresses targeting systems in the United States, Australia, Singapore, Germany, and Mexico.”
reviewerGreyNoise observed 361 malicious IPs exploiting CVE-2025-3248, targeting the US, Australia, Singapore, Germany, and Mexico.Verified against the primary cited source (Recorded Future), figure and country list match exactly. - #7[confirmed][no action needed]in section: Underlying Vulnerability: CVE-2025-3248
“Recorded Future's Insikt Group documented approximately 1,050 internet-exposed Langflow instances on Shodan at the time of Sysdig's July 2026 disclosure”
reviewerRecorded Future's Insikt Group documented approximately 1,050 internet-exposed Langflow instances on Shodan at the time of Sysdig's disclosure.Figure and attribution confirmed directly from Recorded Future's blog. - #10[confirmed][no action needed]in section: Attack Chain and Autonomous AI Agent Behavior
“the LLM agent executed more than 600 distinct purposeful payloads across the operation with no confirmed human direction at each step”
reviewerThe LLM agent executed more than 600 distinct purposeful payloads across the operation with no confirmed human direction at each step.Figure matches primary source. - #11[confirmed][no action needed]in section: Attack Chain and Autonomous AI Agent Behavior
“exploited CVE-2021-29441 (a Nacos authentication bypass), and forged valid JWT tokens using Nacos's well-known unchanged default signing key”
reviewerThe agent exploited CVE-2021-29441 (Nacos authentication bypass) and forged JWT tokens using Nacos's default signing key.Confirmed via direct fetch of Sysdig's post. - #12[confirmed][no action needed]in section: Attack Chain and Autonomous AI Agent Behavior
“The encryption key was printed to stdout but was never stored or transmitted, rendering recovery cryptographically impossible even if the ransom were paid.”
reviewerThe encryption key for the 1,342 encrypted Nacos items was printed to stdout but never stored or transmitted, making recovery impossible even if the ransom were paid.Confirmed. - #13[confirmed][no action needed]in section: Attack Chain and Autonomous AI Agent Behavior
“a failed login at 19:34:36 UTC was corrected at 19:35:07 UTC — 31 seconds later — without human input”
reviewerA failed login at 19:34:36 UTC was corrected 31 seconds later at 19:35:07 UTC without human input.The page characterizes the fix slightly loosely ('corrected' a login vs. the agent deleting/recreating the account and succeeding at 19:35:18), but the core autonomous self-correction claim and the 31-second interval are accurate. - #15[confirmed][no action needed]in section: ENCFORGE: Follow-On AI Model Ransomware Variant
“ENCFORGE is a UPX 5.20-packed Go 1.22.12 ELF binary (1.5MB packed, 4.7MB unpacked; SHA-256 packed: 8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2) that specifically targets machine learning infrastructure files across approximately 180 file extensions.”
reviewerENCFORGE is a UPX 5.20-packed Go 1.22.12 ELF binary, 1.5MB packed/4.7MB unpacked, with the given SHA-256 hash, targeting ~180 file extensions.All technical details confirmed via direct fetch. - #16[confirmed][no action needed]in section: ENCFORGE: Follow-On AI Model Ransomware Variant
“The entire working breakout path was constructed in approximately 5 minutes and 24 seconds.”
reviewerThe entire Docker-socket breakout path to deploy ENCFORGE on the host filesystem was constructed in approximately 5 minutes 24 seconds.Confirmed. - #20[confirmed][no action needed]in the timeline
“Anthropic discloses a real extortion campaign using Claude Code against 17 or more organizations — early evidence of LLM-assisted malicious operations at scale.”
reviewerAnthropic disclosed in August 2025 an extortion campaign using Claude Code against 17 or more organizations.Figure and timing independently confirmed. - #21[confirmed][no action needed]in the timeline
“Anthropic reports a Chinese state-linked operation conducting largely autonomous cyberattacks using LLM agents.”
reviewerIn November 2025, Anthropic reported a Chinese state-linked operation conducting largely autonomous cyberattacks using LLM agents.Consistent with independently known, widely corroborated reporting. - #22[confirmed][no action needed]in section: Unresolved Questions and Analytical Caveats
“The broader claim that earlier AI-assisted attacks (e.g., PromptLock in August 2025, later identified as an NYU research prototype) were not real-world autonomous operations is based on subsequent reporting, not contemporaneous confirmation.”
reviewerPromptLock (August 2025) was later identified as an NYU research prototype, not a real-world autonomous ransomware operation.Accurately and appropriately hedged. - #23[confirmed][no action needed]in section: Cryptocurrency and Credential Targeting
“The LLM agent's credential-harvesting phase explicitly targeted cryptocurrency wallet private keys and seed phrases as a named category alongside other high-value secrets.”
reviewerThe LLM agent's credential-harvesting phase explicitly targeted cryptocurrency wallet private keys and seed phrases as a named category.Confirmed via secondary coverage consistent with Sysdig's reporting; this is the central crypto-relevance claim of the page and holds up. - #24[confirmed][no action needed]in section: Cryptocurrency and Credential Targeting
“researchers noted this may reflect 'the agent talking' rather than a verified exfil action”
reviewerThe staging server claimed as a data backup destination had no independent forensic confirmation of successful exfiltration.Confirmed and appropriately hedged by the page itself. - #25[confirmed][no action needed]in section: Indicators of Compromise and Technical Artifacts
“ENCFORGE delivery server 34.153.223.102 port 9191 (path /.lockd, hidden with leading dot)”
reviewerENCFORGE delivery server was 34.153.223.102 on port 9191, path /.lockd, hidden with a leading dot.Confirmed verbatim via direct fetch.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.