A new variant of the JadePuffer autonomous AI agent, dubbed EncForge, has been observed targeting AI model data with ransomware. This development follows earlier reports this month detailing JadePuffer's capabilities as an agentic threat actor (ATA) that can autonomously execute all phases of a ransomware attack, from initial access to data encryption.
Cloud security firm Sysdig reported that the AI agent demonstrated real-time adaptability, optimizing its intrusion methods to resolve technical obstacles in under a minute. In a recent incident, the attacker revisited a previously compromised Langflow instance, which was vulnerable to CVE-2025-3248. This time, the attack involved EncForge, a Go-based ransomware specifically designed for AI and machine learning (ML) infrastructure.
EncForge targets approximately 180 file extensions, encompassing a broad spectrum of the modern AI/ML stack. This includes AI model checkpoints, vector databases, training datasets, and embedding indices across various common formats. Specific targets include Hugging Face SafeTensors files, PyTorch and TensorFlow models, GGUF and GGML weights, FAISS vector indexes, and training datasets in formats such as Parquet, Arrow, TFRecord, NumPy, and DuckDB. The ransomware's command-line help also references LoRA adapters and legacy GGML files as examples, suggesting a deliberate focus on AI environments rather than a general-purpose file encryptor.
After gaining initial access, the threat actor searched for cloud credentials, API tokens, and accessible internal services. They subsequently discovered an exposed Docker socket, which provided root-level control. When the initial attempt to download the ransomware payload failed, the operator iteratively developed and deployed six Python scripts within five minutes. The final script, `deploy.py v2`, successfully delivered the payload. This script is described as a fully autonomous pipeline that identifies the target process ID, copies EncForge across namespace boundaries via `procfs`, performs a try-mode scan, initiates the live encryption pass, and then verifies execution by counting `.locked` files.
The EncForge ransomware, identified as a Go-based binary named `lockd`, is packed using the Ultimate Packer for eXecutables (UPX). It employs the AES-256 algorithm in counter mode for encryption within a hybrid scheme, where the symmetric key is secured with an RSA-2048 public key. To enhance performance, the malware encrypts only selected portions of each file rather than their entire contents. Encrypted files are appended with the `.locked` extension, and a ransom note is dropped, informing the victim of the attack and providing a unique identifier.
Analysis of the Linux variant of EncForge revealed the presence of Windows anti-recovery functions, such as shadow copy deletion and boot recovery disabling. While the code hinted at a macOS version, its existence remains unconfirmed. Researchers found no evidence of data exfiltration during the intrusion, and EncForge itself does not appear to incorporate a data-stealing mechanism.
The encryption of critical AI assets like model weights, training datasets, and vector indexes could result in significant operational and financial damage for organizations. Estimates suggest potential costs ranging from $75,000 to $500,000 per model, depending on its size and purpose, along with weeks or months of lost training and fine-tuning efforts.
To mitigate such threats, security recommendations include applying available security updates, particularly Langflow version 1.3.0 or later, restricting Docker socket access, running Langflow containers as non-root users, and implementing filesystem-level access controls for directories containing model weights.
