An autonomous AI agent that previously ran an entire ransomware attack without human input has returned with a new weapon. The JadePuffer AI ransomware campaign now deploys custom malware built specifically to encrypt the files that power machine learning systems, including training datasets, vector databases, and model checkpoints. Security researchers say this marks a deliberate shift toward attacking the infrastructure behind AI itself, rather than the generic files most ransomware families go after.
JadePuffer first drew attention as an agentic threat actor capable of moving through every stage of a ransomware attack on its own, from breaking in to encrypting data. Cloud security company Sysdig, which tracked the latest campaign, says the agent adapted to obstacles in real time and found working fixes in under a minute when its tools failed.
How the JadePuffer AI Ransomware Attack Unfolded
The attacker returned to a Langflow instance it had already compromised through CVE-2025-3248, a known vulnerability in the AI workflow platform. From there, it searched for cloud credentials, API tokens, and other reachable services before finding an exposed Docker socket. That misconfiguration handed it root-level control over the environment.
The agent then tried to deliver its ransomware payload, but the first attempt failed. Instead of stalling, it wrote and tested six separate Python scripts over five minutes until one worked. Sysdig described the final script, deploy.py v2, as a complete autonomous pipeline. It locates the target process, copies the ransomware binary across a namespace boundary, runs a test scan, launches full encryption, and then counts the locked files to confirm the attack succeeded.
That level of self-correction is what separates this campaign from earlier automated attacks. The agent did not just execute a script written in advance. It diagnosed a technical failure and engineered its own solution, a capability that used to require a human operator at the keyboard.
Inside the EncForge Ransomware
The payload itself, a Go-based binary called EncForge, is packed to resist analysis and built around one clear purpose: destroying AI assets. It targets close to 180 file extensions tied to modern machine learning workflows. That list includes model checkpoints, Hugging Face SafeTensors files, PyTorch and TensorFlow models, GGUF and GGML weights, FAISS vector indexes, and training data stored in formats such as Parquet, Arrow, TFRecord, NumPy, and DuckDB.
Sysdig also found references to LoRA adapters and legacy GGML files in the binary’s command-line options, evidence the malware was engineered for AI environments specifically rather than repurposed from a generic encryptor.
EncForge encrypts files using AES-256 in counter mode, then secures the encryption key with RSA-2048 public key cryptography. To work faster across large model files, it encrypts only selected portions of each file instead of the full contents. Once finished, it appends a “.locked” extension and drops a ransom note assigning the victim a unique identifier.
Researchers found no sign that JadePuffer stole any data during the intrusion, and EncForge does not appear to include a built-in exfiltration function. So this remains an encryption-only attack for now, but the Linux version already includes Windows-focused anti-recovery features like shadow copy deletion and disabled boot recovery. A macOS variant is hinted at in the code but has not been confirmed.
Why AI Infrastructure Is a High-Value Target
The financial stakes here go beyond a typical ransomware incident. Sysdig estimates that losing model weights, training data, and vector indexes could cost organizations between $75,000 and $500,000 per affected model, depending on its size and purpose. Rebuilding that work often means weeks or months of retraining and fine-tuning, so the pressure to pay a ransom can be significant even without stolen data hanging over the victim.
This is also a reminder that AI platforms carry the same infrastructure weaknesses as any other software. Langflow’s vulnerability gave JadePuffer its foothold, but an exposed Docker socket is what turned that access into full control. Neither issue is unique to AI tools, yet the payoff for attackers is now much higher because AI pipelines concentrate so much value in a small number of files.
Sysdig recommends several defensive steps: updating to Langflow version 1.3.0 or later, restricting access to Docker sockets, running Langflow containers as non-root processes, and applying filesystem-level access controls to directories holding model weights. Locking down remote access more broadly also matters here. Teams managing AI infrastructure from outside the office should use a business VPN to limit who can reach admin panels and internal services in the first place, cutting off one of the paths attackers use to find exposed systems like the Langflow instance JadePuffer exploited.
Final Thoughts
The JadePuffer AI ransomware campaign shows how quickly automated attackers can adapt once they gain a foothold, and how specifically they can target the assets an organization values most. An AI agent that debugs its own delivery failures and builds ransomware aimed at model weights and training data represents a meaningful escalation from earlier automated threats. Organizations running AI infrastructure should treat platforms like Langflow with the same urgency as any internet-facing system, patch known vulnerabilities quickly, and lock down container access before an agent like JadePuffer finds it first.
