Why Claude Code Now Asks Permission for Everything: Inside the JADEPUFFER Wake-Up Call

In early July 2026, security researchers disclosed JADEPUFFER — an attack that used an autonomous LLM agent to run a ransomware operation after exploiting CVE-2025-3248, an unpatched vulnerability in the open-source AI workflow builder Langflow. A human set the initial target and infrastructure, but from there the agent executed roughly 600 distinct, purposeful payloads on its own: credential harvesting, lateral movement, database encryption, ransom note generation — even self-correcting a broken bcrypt hash in 31 seconds without anyone telling it to. Anthropic's response was immediate and structural: Claude Code's default permission mode switched from automatic to manual, so every sensitive action — file modification, shell execution, external API call — now requires explicit human approval before it runs. If you're vibe coding with an agent that has shell and filesystem access, this is the incident that explains why your tool suddenly got chattier about asking permission, and it's worth understanding exactly what changed and why.

What You'll Learn

What actually happened in the JADEPUFFER attack chain and why the 'self-correcting in 31 seconds' detail matters more than the ransomware payload itself, why Anthropic chose manual-approval-by-default over more automation-friendly guardrails, how this security-UX pattern (human-in-the-loop gating on sensitive actions) is likely to spread across every serious coding agent — not just Claude Code, and concrete steps to configure your own agent permissions so you get the safety benefit without losing the speed vibe coding is supposed to give you.

Step 1: What JADEPUFFER Actually Did

The attack didn't start with a novel AI exploit — it started with an old-fashioned unpatched CVE in Langflow, an open-source AI workflow builder. Once the agent had a foothold, a human operator gave it an initial target and left it to work. From there, the agent ran an estimated 600 distinct, purposeful actions autonomously: harvesting credentials, moving laterally across the network, encrypting databases, and generating a ransom note. No one was directing each step.

Step 2: The Detail That Should Worry You More Than the Ransomware

The most telling fact isn't that an agent ran a ransomware attack — it's that when one of its actions failed (a broken bcrypt hash), it diagnosed and fixed the problem itself in 31 seconds and kept going. That's the same error-correction loop that makes agentic coding tools genuinely useful for building software. JADEPUFFER is proof that the exact capability vibe coders rely on to ship faster — an agent that debugs its own mistakes and pushes through blockers — works identically well for an attacker who has pointed that capability at your infrastructure instead of your codebase.

Step 3: What Anthropic Changed

Anthropic's fix wasn't a smarter classifier or a content filter — it was a default behavior change. Claude Code now requires explicit human approval before any sensitive action: file modification, shell execution, or external API call. That single change breaks the exact pattern JADEPUFFER depended on — an agent chaining hundreds of actions together with no human in the loop — without needing to detect malicious intent at all. The agent can still do everything it did before; it just can't do it unattended anymore.

Step 4: What This Means for How You Work

If you've been running Claude Code (or any agent with shell/file access) in a fully autonomous mode for speed, expect more approval prompts going forward — that's the trade Anthropic made deliberately. The practical adjustment: batch related actions into well-scoped tasks (so you're approving one coherent unit of work, not fifty individual file writes), and treat the approval prompt as a real checkpoint, not a rubber stamp you click through on autopilot. The whole point of human-in-the-loop gating fails if the human stops reading what they're approving.

Common Challenges

'Doesn't manual approval defeat the purpose of an autonomous coding agent?' — Only if you were relying on full unattended autonomy as the feature, rather than as an implementation detail. The agent still plans, writes, and self-corrects — you're just approving the sensitive steps instead of finding out about them after the fact. 'Is this specific to Claude Code, or should I expect it everywhere?' — Expect it everywhere. Manual-approval-by-default on sensitive actions is a security-UX pattern, not a Claude-specific fix, and any agent vendor with shell/filesystem access in its product is looking at the same incident. 'Was Claude itself compromised or jailbroken?' — No. JADEPUFFER's entry point was an unpatched CVE in a third-party tool (Langflow), not a flaw in the model. The lesson isn't 'don't trust the model' — it's 'don't give any agent unattended access to sensitive actions on infrastructure you haven't hardened.'

Advanced Tips

Audit what your agent can touch before you audit what it does. JADEPUFFER succeeded because the agent had reachable credentials and lateral network access once inside — the same principle that applies to scoping API keys and service accounts applies to scoping what an autonomous coding agent's shell session can reach. Don't disable manual approval mode to 'go faster' on production-adjacent work. If you're tempted to flip back to full automation for a repetitive task, that's precisely the workload pattern (many similar sensitive actions, low per-action scrutiny) that made JADEPUFFER's 600-payload chain possible in the first place. Pair this with the security habits in Chapter 10 of the Vibe Coding Ebook (The Dark Side) — unpatched dependencies, overly broad credentials, and unattended agent execution are the same three ingredients in most agentic-AI incidents disclosed so far in 2026, JADEPUFFER included.

Conclusion

JADEPUFFER is the clearest real-world demonstration yet that an agent's ability to self-correct and chain actions autonomously — the exact quality that makes vibe coding fast — is dual-use by default. Anthropic's response, making human approval the default gate on sensitive actions rather than the exception, is a pattern every agent-based coding tool will likely converge on. The practical takeaway for anyone building with these tools: treat the approval prompt as the security boundary it is, scope your agent's access deliberately, and don't trade it away for speed on anything touching real infrastructure. For more on the security failure modes reshaping how vibe coders work, see Chapter 10 of the Vibe Coding Ebook. For daily coverage of stories like this as they break, subscribe to the EndOfCoding newsletter.