An AI agent broke into a Langflow server, hit a dead end, then wrote its own way past it. Five minutes and twenty-four seconds later it had a working deployment pipeline for a new strain called ENCFORGE ransomware. That is the headline detail in new research from Sysdig on a threat actor it calls JADEPUFFER. The payload it built is unlike anything researchers have documented before: ransomware that skips your documents and goes straight for your AI models.
The ransomware, ENCFORGE, targets roughly 180 file extensions specific to machine learning infrastructure: PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors files, GGUF and GGML weights used by llama.cpp, FAISS vector indexes, and training data in Parquet, Arrow and TFRecord formats. It leaves ordinary office documents alone. The target is the model, not the desktop.
How the ENCFORGE ransomware got in
Entry came through CVE-2025-3248, a critical, unauthenticated code injection flaw in Langflow’s /api/v1/validate/code endpoint. Any version before 1.3.0 will run arbitrary Python sent to that endpoint with no login required. The bug scores 9.8 on CVSS. It has sat on CISA’s Known Exploited Vulnerabilities catalog since May 2025, after it was used to spread the Flodrix botnet.
Once inside, the operator found an exposed Docker socket. It used the socket to spin up a privileged container with the host’s root filesystem mounted, then dropped into that filesystem with nsenter to run the ransomware binary as if it sat on the host itself. BleepingComputer’s reporting on the campaign adds that the operator also pulled cloud provider keys, database connection strings and API tokens from the host for lateral movement.
Built by the model it was aimed at
What makes this worth reading past the CVE number is how the payload got built. Sysdig director of threat research Michael Clark says the pairing was deliberate: “The combination of Langflow as an entry vector and ENCFORGE as a payload is no coincidence.” Sysdig characterises JADEPUFFER as an autonomous agent, not a human operator working from a playbook. It’s another data point in a trend security teams are only starting to track: AI showing up on the offensive side of the AI security stack itself, not just as a tool defenders use to find bugs faster.
The first deployment attempt failed. Instead of giving up, the operator iterated, writing six separate Python scripts over roughly five minutes to work around the failure. It landed on a script Sysdig labelled deploy.py v2, which handled target discovery, payload delivery and execution verification end to end. Researchers also noted natural-language commentary left in the payload code, an artefact of large language model generation. Ironically, that commentary makes the malware easier for defenders to spot.
A repeat customer, not a new actor
This is not JADEPUFFER’s first outing. Infosecurity Magazine reports the group ran an earlier campaign against AI infrastructure in early July 2026. Sysdig ties this return engagement to the same operator through a shared indicator: the extortion contact address embedded in both sets of ransom notes is identical. Researchers call it the clearest link tying the two campaigns to one operator with, in their words, “a materially upgraded toolkit.”
ENCFORGE itself is a UPX-packed Go binary. It uses AES-256 in counter mode for file encryption, with RSA-2048 wrapping the keys, standard hybrid ransomware cryptography. Before encrypting, it kills processes holding locks on target files, and afterward it deletes itself. The operator can also customise which extensions to target via command-line flags. Notably absent: any data exfiltration or a leak site. This is a destruction play, not the double-extortion model most ransomware crews run today.
Why the target list matters
ENCFORGE ransomware makes that distinction expensive. Rebuilding an encrypted production model is not like restoring a database from backup. Help Net Security’s coverage puts the cost of retraining or rebuilding a single model at $75,000 to $500,000 in cloud GPU time and engineering effort, depending on its size. That figure doesn’t count the weeks or months of fine-tuning work an organisation loses along the way. For companies running production ML pipelines, a model checkpoint is a higher-value target than most of what sits on a typical file share.
What to check now
If you run Langflow anywhere on your network, confirm you are on 1.3.0 or later immediately. Treat any pre-patch instance as compromised until proven otherwise, given the CISA KEV listing and the botnet activity already tied to this bug. Perimeter and platform flaws on that list have a habit of going from advisory to active exploitation within days, and this one has had over a year’s head start. Beyond the patch:
- Audit Docker socket exposure on any host running AI tooling. A socket mounted into a container or reachable by an application process is effectively root access to the host.
- Run ML framework containers as non-root wherever the tooling supports it, and avoid mounting the Docker socket into application containers at all unless there is no alternative.
- Put filesystem-level access controls and immutable, offline backups around model checkpoints, vector stores and training datasets, the same discipline most teams already apply to databases but often skip for ML artefacts.
- Watch for the behavioural pattern here, not just the file hash: rapid, iterative script deployment against a single host followed by a Docker API call to create a privileged container is unusual enough to alert on.
Langflow and tools like it are spreading fast inside engineering teams that are moving quickly and not always looping in security first. ENCFORGE ransomware is a preview of what happens when that gap gets found by an attacker that can iterate as fast as the developers who built the flaw in.
