Key Takeaways

  • Sysdig reports that the JADEPUFFER operator used an AI agent to automate a full intrusion sequence, exploiting CVE-2025-3248 in Langflow.
  • The new ENCFORGE ransomware focuses on AI and machine learning model artifacts, encrypting approximately 180 file types across the modern ML stack.
  • Targeting model artifacts introduces direct operational risks for organizations running AI pipelines, threatening proprietary datasets and recent training progress.

Sysdig's analysis reveals a threat actor that has advanced its tooling to target machine learning assets directly. The group, known as JADEPUFFER, previously used an AI agent to conduct a full ransomware intrusion and has now shifted from database destruction to targeting AI infrastructure. This shift introduces direct operational risks to organizations running AI pipelines.

According to research from PurpleShieldSecurity, JADEPUFFER gained initial access by exploiting CVE-2025-3248 in an internet-facing Langflow instance. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog in 2025, demonstrating that exposed AI application infrastructure is part of active attacker tradecraft. Sysdig reported that the campaign pivoted into Langflow's backing Postgres production database, encrypting 1,342 configuration items and harvesting stored credentials, API keys, and user records before deleting staging files.

The payload in this campaign is a Go-compiled ransomware locker named ENCFORGE, built from an internal project called encfile. The binary contains a default list of approximately 180 target extensions, covering nearly the entire modern machine learning stack. TensorFlow checkpoints, PyTorch weights, ONNX packages, FAISS vector indices, NumPy arrays, DuckDB files, SafeTensors weights, and Apache Arrow datasets all sit within its scope. The AI and ML coverage is not incidental; it reaches across the complete modern ML stack.

The inclusion of GGUF and GGML model formats, commonly used in local LLM deployments, alongside explicit examples of LoRA fine-tuning files, signals deliberate design in AI infrastructure targeting. The target list maps directly to a model training pipeline, structured so operators can extend the list using command line flags.

Targeting model artifacts alters the economic impact of an attack. Retraining production-grade models requires extensive GPU time and engineering effort. ENCFORGE encrypts eligible files it finds, meaning model weights, vector stores, and proprietary datasets that give businesses differentiation can be wiped out in one sweep. Any recent training progress not captured in the last clean snapshot is lost.

The ENCFORGE internal project, encfile, references its companion keygen tool, keyforge, in the binary's error text. Sysdig identified both encfile and keyforge as distinctive identifiers for this toolchain that can be used for detection. Currently, the ransomware appears focused on data loss rather than extortion through data publication.

Analysts at Forbes note that agentic AI systems are beginning to automate full intrusion chains. JADEPUFFER's operation is the first observed ransomware campaign run end-to-end by an AI agent, moving from initial access to credential theft, lateral movement, and destructive database encryption without manual intervention. This indicates agentic tooling can automate the entire intrusion cycle, not just isolated steps.

The 2024 NIST AI RMF emphasizes governance, mapping, and measurement for AI systems, which applies directly as agentic AI becomes part of the attack surface. Additionally, ENISA's 2024 threat landscape reports highlight ransomware and supply-chain dependency risks relevant to AI orchestration stacks. When AI frameworks like Langflow or configuration management systems like Nacos become entry points, everything connected to them faces exposure.

As AI models become core business assets, they inevitably become targets for extortion and disruption. Organizations must now protect model weights, vector indices, and proprietary training datasets with the same operational rigor historically applied to customer databases and production applications.