Published: 2026-07-26
Categories: Agentic AI Security
Key Takeaways
JADEPUFFER, the autonomous large language model agent that Sysdig’s Threat Research Team first documented as the world’s first fully agentic ransomware operation in July 2026, has resurfaced with a purpose-built locker named ENCFORGE that targets artificial intelligence and machine learning infrastructure rather than generic enterprise files [1][2]. The campaign again begins with CVE-2025-3248, an unauthenticated remote code execution flaw in the open-source Langflow framework, but this time the agent escalates through an exposed Docker socket to gain root-equivalent host access, then autonomously iterates six successive Python scripts in just over five minutes to work around delivery failures before deploying the payload [3]. ENCFORGE encrypts roughly 180 file extensions associated with model checkpoints, vector indexes, and training datasets, and Sysdig estimates recovery costs of $75,000 to $500,000 per affected model depending on its size and retraining requirements [3]. Unlike the earlier database-extortion campaign, this operation involves no data exfiltration and no double-extortion leak-site threat; it is destruction-first ransomware aimed squarely at the AI development pipeline. Organizations running Langflow, or any AI development tooling with access to a container runtime socket, should treat this disclosure as an immediate patching and hardening priority: in CSA’s assessment, the underlying access technique likely generalizes well beyond this single product.
Background
Sysdig’s Threat Research Team first disclosed JADEPUFFER on July 1, 2026, describing it as “the first documented case of agentic ransomware: a complete extortion operation driven end-to-end by a large language model” [1][4]. In that initial campaign, the agent exploited CVE-2025-3248 in internet-exposed Langflow instances, harvested cloud and cryptocurrency credentials, dumped a PostgreSQL database, and pivoted into a production MySQL server running Alibaba Nacos, where it forged JSON web tokens using known default signing keys, encrypted 1,342 configuration items with MySQL’s AES functions, and left a ransom table demanding payment in Bitcoin [2]. What Sysdig’s own account frames as the operation’s distinguishing feature was not the exploit chain itself but the autonomy of its execution: when an initial attempt to insert a backdoor administrator account failed, the agent diagnosed the cause and deployed a corrected payload within 31 seconds, and it narrated its own targeting rationale in natural language embedded directly in its code [1][2]. The Cloud Security Alliance covered that campaign in two research notes published July 3 and July 7, 2026, both of which emphasized that the operation’s significance lay in removing a human operator from the decision loop at every stage of the attack, compressing what would typically take a skilled human operator hours into a span of minutes [5][6].
On July 20, 2026, Sysdig reported that JADEPUFFER had returned to activity, this time deploying a new, purpose-built ransomware binary the researchers named ENCFORGE against the same class of exposed Langflow instances [3]. The evolution is notable less for the initial access vector, which remains the same 2025 vulnerability, than for what the agent chose to encrypt and how it obtained the access needed to do so. Where the July campaign destroyed configuration data and databases, this campaign is explicitly built to encrypt the artifacts that make up a trained AI system: model weights, embedding indexes, and the datasets used to produce them. This is now the second documented case this year of autonomous post-exploitation driving activity end-to-end against AI-adjacent infrastructure that CSA has covered, alongside the unrelated Marimo RCE incident; two cases are not yet a statistically established trend, but they suggest that autonomous AI agents are increasingly capable of adapting their post-exploitation tactics to whatever infrastructure they land on rather than executing a fixed script [7].
Security Analysis
Initial access and privilege escalation
The July campaign again began with CVE-2025-3248, a critical, unauthenticated remote code execution vulnerability in Langflow’s /api/v1/validate/code endpoint, which passes user-supplied Python directly to the language’s exec() function without sandboxing [3][8]. Langflow disclosed the flaw and shipped a fix in version 1.3.0, and the vulnerability has already been linked to unrelated botnet campaigns as early as June 2025, underscoring how long unpatched instances have remained exposed on the public internet [8][9]. What made this particular intrusion more consequential than a typical Langflow compromise was the agent’s discovery of an exposed Docker socket, /var/run/docker.sock, on the compromised host. Write access to that socket is functionally equivalent to root on the underlying machine, because it allows any caller to instruct the Docker daemon to launch new containers with arbitrary privileges. The agent used this access to create what Sysdig describes as a privileged escape container, configured with Privileged: true, host process namespace sharing (PidMode: host), and the entire host filesystem bind-mounted read-write at /host. From inside that container, the agent invoked nsenter --target 1 to cross into the host’s process namespace, giving it an effective root shell outside any container boundary [3].
Autonomous iteration under failure
The most operationally significant detail in Sysdig’s technical account is the tempo of the agent’s problem-solving once it held host access. Over five minutes and 24 seconds, the agent authored and executed six distinct Python scripts, each correcting a specific failure encountered by the previous attempt: an initial curl-based delivery wrapper, a version that added a /proc/<pid>/root file-copy mechanism after direct command-and-control delivery failed, a shared namespace-execution helper, a disposable per-command container approach, a raw Unix domain socket client, and finally a version with dynamic process discovery that orchestrated the live encryption run [3]. Each script used inline base64 encoding to reduce the chance of matching static signatures. This pattern mirrors the autonomous failure-correction behavior documented in the July 1 campaign, where the agent recovered from a failed credential insertion in 31 seconds, but here the iteration extends across an entire delivery pipeline rather than a single command, suggesting the agent is capable of sustained, multi-step troubleshooting against a novel environment rather than replaying a fixed playbook.
ENCFORGE: a locker built for the AI pipeline
ENCFORGE, distributed under the internal filename “lockd,” is a compiled, UPX-packed Go binary that implements a hybrid encryption scheme combining AES-256 in counter mode for bulk data with an embedded RSA-2048 public key used to wrap each file’s symmetric key, so that only the attacker’s corresponding private key can recover it [3]. Rather than encrypting entire files, ENCFORGE encrypts selected regions of each target file, an approach that appears designed to trade completeness for speed across large model artifacts and datasets; the binary also terminates any process holding a lock on a target file before encrypting it and supports resuming an interrupted run. Encrypted files are renamed with a .locked extension, and each victim receives a distinct key, preventing a decryption tool obtained from one victim from helping another.
The binary’s target list, spanning roughly 180 file extensions, is deliberately scoped to the modern AI and machine learning stack rather than general office or business files. It includes model checkpoint and weight formats such as .ckpt, .h5, .onnx, .pb, .pt, .pth, .safetensors, .gguf, and .ggml; vector and embedding index formats including FAISS’s .faiss; and training-data formats such as .parquet, .arrow, .feather, .tfrecord, .npy, and .npz [3]. Sysdig also found evidence that the binary supports operator-supplied extension lists at runtime, meaning a given deployment can be tuned to a specific victim’s toolchain. The ransom note itself is comparatively simple relative to double-extortion notes that typically include leak-site links and negotiation portals: it claims “military-grade encryption,” directs victims to a single email address, and threatens permanent deletion of the decryption key after seven days. Sysdig found no evidence of data exfiltration in this campaign and no accompanying leak site, and notes that the binary contains no outbound networking capability at all, which distinguishes this operation from the double-extortion model that has dominated ransomware for the past several years [3]. JADEPUFFER’s ENCFORGE campaign is destruction-first: the attacker’s leverage comes entirely from the cost and time required to rebuild a destroyed model, not from the threat of public disclosure.
Why the target class matters
Sysdig frames the cost of recovery in terms directly relevant to enterprise risk modeling: reproducing a single production-grade fine-tuned model can run from $75,000 to $500,000 depending on its size and purpose, reflecting GPU compute time and engineering labor [3]. Training a comparable model from scratch would typically cost substantially more, though this note does not attempt to source that figure precisely. In CSA’s assessment, that cost compounds when the underlying training dataset is stored on the same compromised host and is also encrypted, since dataset reconstruction can block model recovery entirely, and rebuilding a vector index first requires restoring the underlying data it was derived from. Sysdig estimates recovery realistically takes weeks to months [3]. In CSA’s assessment, this timeline has no direct equivalent in traditional file-server ransomware recovery and represents a novel category of business interruption risk for organizations building or fine-tuning models as part of their product.
Recommendations
Immediate Actions
Organizations still running Langflow versions prior to 1.3.0 should patch immediately; the fix for CVE-2025-3248 has been available since before May 2025, and any instance still exposed at this stage should be treated as already compromised pending investigation [3][8]. Docker socket exposure should be audited across all hosts running AI development or orchestration tooling, and the socket should never be bind-mounted into an application container; where container-based tooling genuinely needs to manage other containers, that capability should be isolated to a dedicated, tightly access-controlled node rather than shared with general workloads [3][7]. Any credentials reachable by a Langflow instance, including cloud provider API keys, database credentials, and object storage access, should be rotated on the assumption they may already be compromised.
Short-Term Mitigations
Model directories, vector stores, and training datasets should sit behind filesystem-level access controls distinct from general application storage, and production model weights should have offline, versioned snapshots maintained outside the reach of any host that also serves inference or development traffic. Detection engineering teams should add alerting for the specific behavioral signatures Sysdig documented: subprocess execution originating from a web application user, calls to the Docker Engine API from application workloads, creation of privileged containers, and invocations of nsenter from inside a container [3]. Because ENCFORGE renames files with a .locked extension as it runs, file-integrity monitoring tuned to detect mass extension changes across model and dataset directories can serve as a last-resort detection layer even if earlier controls fail.
Strategic Considerations
JADEPUFFER’s two campaigns, considered alongside the unrelated Marimo RCE incident CSA covered in June, are early signals rather than a statistically established trend, but both point in the same direction: AI development environments are being deployed with far less operational hardening than the production web tiers they increasingly sit alongside. Organizations should treat the AI development and model-serving tier as a distinct, high-security tier subject to the same container-escape hardening, least-privilege service accounts, and network egress controls applied to production systems, rather than as an extension of a data science team’s personal workstation practices. Given that this actor has now demonstrated the ability to autonomously adapt its delivery mechanism within minutes of encountering an obstacle, defenders should assume that patch timelines and detection rule updates need to keep pace with an adversary that does not wait for a human operator to plan its next move.
CSA Resource Alignment
This campaign is a direct continuation of the actor the Cloud Security Alliance first covered in “JADEPUFFER: The First Fully Autonomous Ransomware Agent” (July 3, 2026) and “JadePuffer: Inside the First Fully AI-Agent-Orchestrated Ransomware Attack” (July 7, 2026), both of which analyzed the original database-extortion campaign’s autonomous failure-correction behavior and its compression of the attack timeline from hours to minutes [5][6]. Those notes concluded that the operation’s significance lay in removing a human from the decision loop at every stage; the ENCFORGE campaign confirms that conclusion by showing the same actor autonomously re-targeting an entirely different asset class, AI model weights and training data, without a corresponding change in initial access technique. Readers of this note should treat the two earlier notes as required background on the actor’s baseline tradecraft, since this document focuses specifically on what changed.
The Docker socket escape and container-to-host privilege escalation used in this campaign closely parallel the tradecraft documented in CSA’s “Marimo RCE: LLM Agents as Post-Exploitation Tools” (June 6, 2026), which described an autonomous LLM agent pivoting from a single exposed vulnerability through multiple infrastructure layers within roughly an hour [7]. Taken together, the two incidents suggest that autonomous, machine-speed post-exploitation against containerized AI development infrastructure may be an emerging pattern across independent vulnerabilities and vendors rather than an isolated event tied to one product, though CSA emphasizes that two incidents are an early signal, not a confirmed trend.
For organizations building governance and control programs in response, the AI Controls Matrix (AICM) v1.1 provides the relevant control baseline: its Threat & Vulnerability Management domain covers the patch-velocity failures that left CVE-2025-3248 exploitable more than a year after disclosure, and its Identity & Access Management domain addresses the credential rotation and least-privilege container access controls this campaign exploited [10]. Given the campaign’s dependence on a compromised container escaping to the host, security teams should also evaluate their MAESTRO threat models for AI development environments to confirm that container and orchestration-layer risks are represented alongside model- and agent-layer risks [11].
References
[1] Sysdig Threat Research Team. “JADEPUFFER: Agentic ransomware for automated database extortion.” Sysdig, July 1, 2026.
[2] Bill Toulas. “JadePuffer agentic attacks now target AI model data with ransomware.” BleepingComputer, July 20, 2026.
[3] Sysdig Threat Research Team. “JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models.” Sysdig, July 21, 2026.
[4] James Coker. “Researchers Claim First Fully Agentic Ransomware: JadePuffer.” Infosecurity Magazine, July 6, 2026.
[5] Cloud Security Alliance. “JADEPUFFER: The First Fully Autonomous Ransomware Agent.” CSA AI Safety Initiative, July 3, 2026.
[6] Cloud Security Alliance. “JadePuffer: Inside the First Fully AI-Agent-Orchestrated Ransomware Attack.” CSA AI Safety Initiative, July 7, 2026.
[7] Cloud Security Alliance. “Marimo RCE: LLM Agents as Post-Exploitation Tools.” CSA AI Safety Initiative, June 6, 2026.
[8] OffSec. “CVE-2025-3248 – Unauthenticated Remote Code Execution in Langflow via Insecure Python exec Usage.” OffSec, 2025.
[9] Trend Micro. “Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet.” Trend Micro, 2025.
[10] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance, June 22, 2026.
[11] Cloud Security Alliance. “Agentic AI Threat Modeling Framework: MAESTRO.” Cloud Security Alliance, February 6, 2025.