JADEPUFFER: AI Agent Automates Langflow RCE for Database Encryption

---
title: Potential Langflow RCE Exploitation Shell Spawn
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of Langflow RCE by identifying the Python-based Langflow process spawning a shell or system command.
references:
 - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.execution
 - attack.t1059.004
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   ParentImage|endswith: '/python'
   ParentCommandLine|contains: 'langflow'
   Image|endswith:
     - '/sh'
     - '/bash'
     - '/zsh'
     - '/python'
 condition: selection
falsepositives:
 - Legitimate administrative debugging by developers
level: high
---
title: AI Agent Database Encryption Activity
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects suspicious encryption or wiping activity on a database server, potentially indicative of JADEPUFFER AI agent impact.
references:
 - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.impact
 - attack.t1486
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   ParentImage|endswith:
     - '/postgres'
     - '/mysqld'
     - '/mongod'
     - '/sqlservr'
   Image|endswith:
     - '/openssl'
     - '/gpg'
     - '/rm'
     - '/shred'
   CommandLine|contains:
     - 'encrypt'
     - '-aes'
     - '-rf' # recursive force delete
 condition: selection
falsepositives:
 - Legitimate database backup or export routines
level: critical
---
title: AI Agent Tooling Outbound Connections
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects unusual outbound connectivity from a web application context to AI API providers or non-standard ports, typical of AI agent C2.
references:
 - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
 category: network_connection
 product: linux
detection:
 selection:
   Image|endswith: '/python'
   Initiated: true
   DestinationPort:
     - 443
     - 80
   DestinationHostname|contains:
     - 'api.openai.com'
     - 'api.anthropic.com'
     - 'llm.api'
 condition: selection
falsepositives:
 - Verified usage of AI features within the application
level: medium

// Hunt for Langflow parent processes spawning shells
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ParentProcessName has "python" 
| where ParentProcessCommandLine contains "langflow"
| where ProcessName in ("sh", "bash", "zsh", "python", "perl")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ParentProcessCommandLine
| extend Actor = "Potential JADEPUFFER RCE"

// Hunt for database encryption impact (Linux)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessName in ("openssl", "gpg", "shred", "rm")
| where ParentProcessName in ("postgres", "mysqld", "mongod", "sqlservr")
| project Timestamp, DeviceName, ProcessCommandLine, ParentProcessName
| where ProcessCommandLine contains any ("encrypt", "aes", "-rf")

-- Identify Langflow processes and their children
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ 'python' AND CommandLine =~ 'langflow'

-- Hunt for recent file encryption or deletion in DB directories
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/**/*.{enc,locked,encrypted}')
WHERE Mtime > now() - 24h

-- Check for network connections established by Python scripts (Agent C2)
SELECT Fd, Family, RemoteAddr, State, Pid
FROM netstat()
WHERE Pid IN (SELECT Pid FROM pslist() WHERE Name =~ 'python') AND State =~ 'ESTABLISHED'

#!/bin/bash
# Security Arsenal - JADEPUFFER Response Script
# Checks for Langflow processes and isolates the instance if compromise is suspected

LANGFLOW_PROCESS=$(pgrep -f "langflow")

if [ -n "$LANGFLOW_PROCESS" ]; then
    echo "[!] Langflow process detected: PID $LANGFLOW_PROCESS"
    # In a real incident, isolate the container/host immediately.
    # Example: iptables -A INPUT -p tcp --dport 7860 -j DROP
    echo "[!] ACTION: Stop Langflow service to prevent further automation."
    # systemctl stop langflow  # Uncomment if running as a service
    # docker stop <langflow_container_id> # Uncomment if running in docker
else
    echo "[+] No Langflow process found."
fi

# Check for recent encryption activity in /var/lib/postgresql (example path)
echo "[*] Scanning for recent encrypted file extensions in /var/lib..."
find /var/lib -name "*.enc" -o -name "*.locked" -mtime -1 2>/dev/null

echo "[*] Checking for outbound connections to AI API endpoints..."
ss -tulnp | grep -E 'ESTABLISHED.*python'

echo "[*] Remediation: Verify Langflow is patched to the latest version immediately."