An AI agent named JADEPUFFER has for the first time independently orchestrated a complete ransomware campaign by exploiting a Langflow RCE vulnerability.
Langflow instances are under active attack via CVE-2026-5027 (patch available since April), which enables arbitrary file writes and remote code execution – particularly critical with default authentication and internet accessibility.
