"The binary targets approximately 180 file extensions, with a deliberately broad sweep of the modern AI/ML stack, including model checkpoints, vector databases, training datasets, and embedding indices in nearly every current format," Sysdig warned in its analysis of a recent intrusion.
Sysdig: JadePuffer returned to a CVE-2025-3248-exposed Langflow instance
Cloud security company Sysdig reported that the autonomous agentic threat actor known as JadePuffer revisited a previously breached Langflow instance vulnerable to CVE-2025-3248. According to Sysdig, the attacker deployed a new Go-based ransomware payload named EncForge (also referenced as ENCFORGE/lockd) that Sysdig says was "built specifically for AI and machine learning (ML) infrastructure."
How the attack chain unfolded: Docker socket, iterative scripting, and procfs crossing
Sysdig's report describes a multi-step, adaptive intrusion. After the actor gained access and searched for cloud credentials, API tokens, and internal services, an exposed Docker socket provided root-level control. When an initial download of the ransomware payload failed, the operator iteratively developed and deployed six Python scripts over roughly five minutes. Sysdig quoted its own analysis: “deploy.py v2 is the completed payload: a fully autonomous pipeline that discovers the target PID, copies ENCFORGE across the namespace boundary via procfs, runs a try-mode scan, launches the live encryption pass, and then counts .locked files to verify execution.”
EncForge: ransomware purpose-built to hit AI assets
EncForge is a UPX-packed Go binary that, according to Sysdig, targets roughly 180 file extensions across the modern AI/ML stack. Sysdig lists specific targets that the malware recognizes: AI model checkpoints; Hugging Face SafeTensors files; PyTorch and TensorFlow models; GGUF and GGML weights; FAISS vector indexes; and training datasets in Parquet, Arrow, TFRecord, NumPy, and DuckDB formats. Sysdig also notes the binary's command-line help uses LoRA adapters and legacy GGML files as example targets, which the company interprets as evidence the payload was deliberately engineered for AI environments rather than being a generic file encryptor.
Encryption is performed with AES-256 in counter mode in a hybrid scheme where the symmetric key is protected with an RSA-2048 public key. To speed execution, the malware encrypts selected portions of each file rather than entire contents; encrypted files are appended with the .locked extension and a ransom note is dropped assigning a unique identifier to the victim. Sysdig found no evidence that JadePuffer exfiltrated data during this intrusion, and reported that EncForge itself does not appear to include a data-stealing mechanism.
Analysis of the Linux variant also revealed Windows-oriented anti-recovery functions—shadow copy deletion and boot recovery disabling—and the code hints at a macOS variant that remains unconfirmed.
Estimated impact: weeks of training lost and per-model financial ranges
Sysdig warned that encryption of model weights, training datasets, and vector indexes could cost organizations weeks or months of retraining or fine-tuning. The report provides a financial damage range for affected models: roughly $75,000 to $500,000 per model, "depending on its size and purpose." That figure reflects Sysdig's assessment of the time, compute, and development effort embedded in modern AI workflows when core assets are locked.
What this means for Langflow operators, cloud security teams, and model owners
- Langflow operators: Apply available security updates—Sysdig specifically recommends Langflow version 1.3.0 or later—and avoid running Langflow containers as root.
- Cloud security and platform teams: Restrict access to the Docker socket and harden container host permissions; Sysdig also suggests applying filesystem-level access controls to directories that hold model weights.
- Model owners and MLOps teams: Prioritize backups of model checkpoints, vector stores, and training datasets, and treat those artifacts as high-value assets; be aware that partial-file encryption can still render models unusable even if full-file exfiltration is not observed.
Sysdig's account also includes a broader detection note: the report references a claim that "Security teams log 54% of successful attacks and alert on just 14%," underscoring the gap between event logging and actionable detection. The incident demonstrates how a self-directed agent can iterate in real time to overcome delivery failures—Sysdig observed the agent developing fixes and solving delivery issues within a minute—then execute a focused encryption campaign on AI assets.
For operators of AI infrastructure, the immediate steps are concrete: patch Langflow (1.3.0+), restrict Docker socket access, run containers non-root, and apply strict filesystem controls around model artifacts. For defenders, the intrusion is a reminder that agentic automation can combine adaptive exploitation with tooling tailored to the unique file formats of AI development.
