The first ransomware operation run end to end by an AI agent — Sysdig calls it JADEPUFFER — did not break in with a jailbroken frontier model or a fresh zero-day. It walked through CVE-2025-3248, a year-old unauthenticated remote-code-execution flaw in Langflow, the open-source LLM/agent builder thousands of founders self-host. The bug was fixed in Langflow 1.3.0 and has been on CISA's Known Exploited Vulnerabilities list since May 2025. The servers it hit were just never updated.

That is the whole story, and it is good news disguised as bad news. If the entry point had been an unstoppable AI superweapon, there would be nothing to do. Instead the entry point was ordinary neglect that an agent automated: a public, unpatched builder, a database reachable with reused root credentials, secrets sitting in readable files, and wide-open outbound network access. Every one of those is a checklist item you can close this afternoon.

Here is the pass. It applies to Langflow, but also to Flowise, n8n, Dify, and any agent-building surface you run yourself.

1. Get the builder off the public internet#

The exploit only mattered because the instance was internet-reachable and unauthenticated. A scan found it; the payload followed. So the highest-leverage fix is also the cheapest: do not expose your agent builder to the open web.

Put it behind a VPN, a private VPC, or at minimum an authenticating reverse proxy. If you must check whether you are currently exposed, look from the outside:

# From a machine OUTSIDE your network — does the UI answer at all?
curl -sS -o /dev/null -w "%{http_code}\n" http://YOUR_PUBLIC_IP:7860/

# Any 200/302 here means the world can reach it. That is the finding.

If that returns anything but a connection refused or a 401/403, stop and fix this first. Everything below is defense in depth behind this line.

2. Patch the known-exploited surface#

JadePuffer used a bug with a patch that predated the attack by more than a year. You do not need to chase novel vulnerabilities to avoid this class of incident — you need to not run software that appears on CISA's KEV catalog unpatched.

# Check your running Langflow version
python -m langflow --version      # or: pip show langflow

# CVE-2025-3248 was fixed in 1.3.0. Anything older is exploitable.
pip install --upgrade "langflow>=1.3.0"

Make this a standing job, not a one-off: subscribe to the KEV feed and pin every builder to a patched release. A known-exploited bug is a bug someone has already written the automation for.

3. Scope database credentials to one service#

Once inside, the agent dumped the builder's PostgreSQL database, harvested credentials, and — this is the part that turned a foothold into a disaster — pivoted to a production database using reused root credentials. One over-privileged secret connected two systems that should never have been one blast radius.

Give every service its own least-privilege user. The builder's database account should be able to touch the builder's database and nothing else:

-- One user, one database, no superuser
CREATE USER langflow_svc WITH PASSWORD 'use-a-vaulted-secret';
GRANT CONNECT ON DATABASE langflow TO langflow_svc;
GRANT USAGE ON SCHEMA public TO langflow_svc;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO langflow_svc;
-- Explicitly NOT: SUPERUSER, CREATEDB, or reuse of a shared root password

If a compromised builder credential cannot open your production database, the pivot that made JadePuffer devastating simply fails.

4. Vault your secrets — don't leave them on disk#

The agent searched for environment variables and sensitive files and found credentials it could read directly. A process that can be made to run arbitrary code can read anything the process can read. So the goal is to make sure that set is small.

Inject secrets at runtime from a manager — Vault, a cloud secrets manager, Docker/Kubernetes secrets — rather than baking them into a .env file that lives next to the app. Concretely: no long-lived API keys or database passwords sitting in plaintext in the container's filesystem or in docker-compose.yml.

# Instead of hardcoding, reference an external secret
services:
  langflow:
    image: langflowai/langflow:latest
    secrets:
      - db_password         # mounted at /run/secrets, not in the image
secrets:
  db_password:
    external: true

You will not eliminate every readable secret, but every one you remove is one the next agent doesn't get for free.

5. Egress-lock the box#

An agent that has code execution still needs the network to do damage: to pull tooling, to beacon (JadePuffer used a cron job every 30 minutes), and to exfiltrate. A default-deny egress policy breaks all three.

Most self-hosted builders need to reach exactly one or two model endpoints and nothing else. Enforce that:

# Default-deny outbound, allow only what the builder actually needs
ufw default deny outgoing
ufw allow out to <your-model-provider-ip> port 443
ufw allow out 53                    # DNS
# No general internet egress: no arbitrary tool downloads, no beacon home

In Kubernetes, the same idea is a NetworkPolicy with an empty default-deny egress plus explicit allows. The point is identical: if the box can't call out, an attacker who lands there is stuck in a room with no exits.

6. Alert on inhuman tempo#

The final layer catches what the first five miss. The tell in the Sysdig writeup was not linguistic — it was operational. The agent went from a failed login to a working fix in about 31 seconds and fanned out hundreds of coordinated payloads. Humans don't move like that.

You don't need an AI-specific product to notice it. Alert on the shape of automation: a spike in failed-then-successful auth within seconds, a burst of new outbound connections, database reads far above your normal baseline, a process spawning shells it never spawns. These are cheap detections and they fire on any fast automated operator, regardless of which model is driving it — which, as detecting the malicious model misses the point explains, is exactly where the defensive frontier is heading.

None of this is new security. It is the same hygiene that has always separated a foothold from a breach — off the public internet, patched, least-privilege, secrets vaulted, egress-locked, monitored. What changed is the economics of the attacker: automation makes finding and chaining your ordinary misconfigurations cheap enough to do at scale. The good news is that the countermeasures got no harder. A container is still not a sandbox, a reused root password is still a gift, and a box that can't call home still can't call home. Run the six steps, and the next JadePuffer that finds your builder lands somewhere with nothing worth taking and nowhere to go.