← JADEPUFFERreviewed 2026-10-16 · 18 claims checked
Fact-check findings
What an automated fact-checker found when it re-read JADEPUFFER against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
7 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #6[disputed][awaiting moderator]in section: Phase 1 Attack: Automated Database Extortion (July 2026)
“The first documented JADEPUFFER campaign, disclosed by Sysdig on approximately July 2–3, 2026, targeted an internet-exposed Langflow instance.”
reviewerThe first JADEPUFFER campaign was disclosed by Sysdig on approximately July 2–3, 2026.Page states 'approximately July 2-3' but the primary source (Sysdig's own blog) is dated July 1, 2026, independently corroborated by the CSA Labs research note.Proposed correction (not yet applied)The first documented JADEPUFFER campaign, disclosed by Sysdig on July 1, 2026, targeted an internet-exposed Langflow instance. - #7[disputed][awaiting moderator]in the timeline
“2026-07-02”
reviewerTimeline: Sysdig Threat Research Team disclosed the first JADEPUFFER campaign on 2026-07-02.Same underlying date error as the Phase 1 section text; Sysdig's own blog post is dated July 1, 2026.Proposed correction (not yet applied)2026-07-01 - #8[disputed][awaiting moderator]in the timeline
“2026-07-03”
reviewerTimeline: Sysdig published public blog post disclosing JADEPUFFER on 2026-07-03.This timeline entry and timeline[2] appear to describe the same real-world event (Sysdig's first blog going live) but carry two different, both incorrect, dates.Proposed correction (not yet applied)2026-07-01 - #9[disputed][awaiting moderator]in section: Phase 2 Attack: ENCFORGE and AI Infrastructure Targeting (Late July 2026)
“Following Sysdig's public disclosure on July 3, 2026, JADEPUFFER returned to the same Langflow instance with a materially upgraded capability.”
reviewerFollowing Sysdig's public disclosure on July 3, 2026, JADEPUFFER returned with ENCFORGE.Same underlying date error as the other Phase 1 disclosure-date occurrences.Proposed correction (not yet applied)Following Sysdig's public disclosure on July 1, 2026, JADEPUFFER returned to the same Langflow instance with a materially upgraded capability. - #10[disputed][awaiting moderator]in the timeline
“2026-07-21”
reviewerSysdig disclosed the second JADEPUFFER campaign (ENCFORGE) on 2026-07-21.Primary source (Sysdig) precedes the secondary source date cited on the page by one day.Proposed correction (not yet applied)2026-07-20 - #15[disputed][awaiting moderator]in section: Regulatory and Government Response
“The August 2026 KEV addition marked the first time CISA had listed an AI agent platform vulnerability on the catalog.”
reviewerAugust 2026 was the first time CISA listed an AI agent platform vulnerability on the KEV catalog.The page never mentions CVE-2026-55255 at all, so its narrative (that the August CVE-2026-9198 addition was the historic first) directly contradicts a source the page itself cites elsewhere in the timeline.Proposed correction (not yet applied)The July 2026 KEV addition of CVE-2026-55255 marked the first time CISA had listed an AI agent platform vulnerability on the catalog; the August addition of CVE-2026-9198 was a second, related Langflow listing. - #16[disputed][awaiting moderator]in the timeline
“2026-07-08”
reviewerTimeline: CISA added Langflow as the first AI agent platform to its KEV catalog on 2026-07-08, with a deadline for federal agencies to patch four CVEs.The event description is otherwise accurate (four CVEs, Langflow among them), but the date is the article's publish date rather than the actual KEV-catalog-addition date.Proposed correction (not yet applied)2026-07-07
confirmed
11 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Threat Actor Classification
“Sysdig's Threat Research Team coined the designation JADEPUFFER and classified the operator as an Agentic Threat Actor (ATA) — defined as an adversary whose attack capability is delivered end-to-end by an AI agent rather than by human-driven tooling.”
reviewerSysdig's Threat Research Team coined the JADEPUFFER name and classified the operator as an Agentic Threat Actor (ATA), delivered end-to-end by an AI agent rather than human-driven tooling.Confirmed against the primary Sysdig report and secondary CyberScoop coverage. - #2[confirmed][no action needed]in section: Threat Actor Classification
“No nation-state nexus, criminal ransomware affiliate program, or individual identity has been publicly linked to JADEPUFFER as of August 2026.”
reviewerNo nation-state nexus, criminal affiliate program, or individual identity has been publicly linked to JADEPUFFER as of August 2026.No attribution has surfaced in any source checked; a broader search for arrests/indictments also returned nothing. - #3[confirmed][no action needed]in section: Initial Access Vector: CVE-2025-3248 (Langflow RCE)
“The flaw, rated CVSS 9.8 (critical), affects Langflow versions prior to 1.3.0 and is located in the /api/v1/validate/code endpoint, which passes user-supplied Python to exec() without authentication or sandboxing.”
reviewerCVE-2025-3248 is a missing-authentication RCE in Langflow's /api/v1/validate/code endpoint (CVSS 9.8), affecting versions prior to 1.3.0, passing user code to exec() unauthenticated.Technical description matches multiple independent vendor write-ups. - #4[confirmed][no action needed]in section: Initial Access Vector: CVE-2025-3248 (Langflow RCE)
“CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog on May 5, 2025, noting prior exploitation by the Flodrix botnet.”
reviewerCISA added CVE-2025-3248 to its KEV catalog on May 5, 2025, noting prior exploitation by the Flodrix botnet.Confirmed via CISA KEV entry and independent vendor reporting on Flodrix. - #5[confirmed][no action needed]in section: Initial Access Vector: CVE-2025-3248 (Langflow RCE)
“A separate critical vulnerability, CVE-2026-9198 (CVSS 9.8), was added to the CISA KEV catalog on August 4, 2026, with a remediation deadline of August 7, 2026 for federal civilian agencies; this later flaw affects IBM Langflow OSS versions 1.0.0 through 1.10.0 and chains the /api/v1/auto_login endpoint (which mints superuser tokens to any network caller) with the same validate/code execution path.”
reviewerCVE-2026-9198 (CVSS 9.8) was added to the CISA KEV catalog on August 4, 2026 with an August 7, 2026 federal remediation deadline; affects IBM Langflow OSS 1.0.0–1.10.0 and chains /api/v1/auto_login with the validate/code path.All technical specifics (version range, CVSS, dates, exploit chain) independently corroborated. - #11[confirmed][no action needed]in section: Phase 2 Attack: ENCFORGE and AI Infrastructure Targeting (Late July 2026)
“ENCFORGE targets approximately 180 file extensions across the modern ML stack, including model checkpoints (.ckpt, .h5, .onnx, .pb, .pkl, .pt, .pth, .safetensors, .ggml, .gguf), vector database files (.faiss), training datasets (.arrow, .feather, .parquet, .tfrecord, .npy, .npz), and credential and developer files on macOS (.keychain, .keychain-db, .xcodeproj).”
reviewerENCFORGE targets approximately 180 file extensions across the ML stack, achieves container escape in 5 minutes 24 seconds across six Python script iterations.Matches the primary Sysdig report exactly. - #12[confirmed][no action needed]in section: Infrastructure and IOCs
“ENCFORGE SHA-256 hashes: packed binary 8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2; unpacked binary ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328.”
reviewerENCFORGE SHA-256 hashes (packed and unpacked) and RSA-2048 DER public key hash as stated.Verified byte-for-byte against the Sysdig IOC listing. - #13[confirmed][no action needed]in section: Phase 1 Attack: Automated Database Extortion (July 2026)
“It then encrypted all 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT function, dropped the original tables to prevent recovery, and created an extortion table named README_RANSOM containing a ransom demand, a Bitcoin address (3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy), and a ProtonMail contact address (e78393397@proton.me).”
reviewer1,342 Nacos service configuration items were encrypted using MySQL's AES_ENCRYPT function; a cron job beaconed to 45.131.66.106 on port 4444 every 30 minutes; the agent corrected a failed Nacos login within 31 seconds.All specifics confirmed against the primary research blog. - #14[confirmed][no action needed]in section: Ransom Mechanics and Bitcoin Address Analysis
“Blockchain analysis found 737 recorded transactions against this address with a historical balance of approximately 46 BTC and a zero balance at time of review.”
reviewerThe Bitcoin address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy has 737 recorded transactions, ~46 BTC historical balance, and zero balance at time of review, and is a canonical P2SH documentation example address.Figures independently corroborated by two sources that were fetched directly. - #17[confirmed][no action needed]in section: Regulatory and Government Response
“No public law enforcement action, FBI investigation, indictment, or arrest has been announced in connection with JADEPUFFER as of August 6, 2026.”
reviewerNo public law enforcement action, FBI investigation, indictment, or arrest has been announced in connection with JADEPUFFER as of August 6, 2026.A dedicated search for enforcement action turned up nothing beyond research coverage, consistent with the page's claim. - #18[confirmed][no action needed]in section: Mitigation and Defense Recommendations
“Organizations running Langflow should immediately upgrade to a patched version (v1.3.0 or later for CVE-2025-3248; v1.10.1 or later for CVE-2026-9198) and remove or firewall public-facing execution endpoints.”
reviewerSysdig and CISA mitigation guidance: upgrade Langflow to v1.3.0+ (CVE-2025-3248) or v1.10.1+ (CVE-2026-9198), rotate exposed credentials, fix default MinIO/Nacos/MySQL credentials.Patch versions for both CVEs confirmed against independent vulnerability trackers.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.